{"resultsPerPage":655,"startIndex":0,"totalResults":655,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-25T03:32:20.711","vulnerabilities":[{"cve":{"id":"CVE-2026-102793","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T00:16:33.743","lastModified":"2026-10-01T16:17:35.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Ziroom","product":"ZHOME A0101","cpes":["cpe:2.3:a:ziroom:zhome_a0101:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:C/I:C/A:C","baseScore":8.3,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.4,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:14:37.386953Z","id":"CVE-2026-102793","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-77"}]}],"references":[{"url":"https://github.com/waltz-sketch/Ziroom/blob/main/set_time_zone_hostname_command_injection.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102793","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914649","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914650","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411470","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411470/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102794","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T00:16:34.963","lastModified":"2026-09-30T14:17:24.647","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Ziroom","product":"ZHOME A0101","cpes":["cpe:2.3:a:ziroom:zhome_a0101:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:C/I:C/A:C","baseScore":8.3,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":6.4,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:58:18.142652Z","id":"CVE-2026-102794","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-77"}]}],"references":[{"url":"https://github.com/waltz-sketch/Ziroom/blob/main/zrnetwork_ping_url_command_injection.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102794","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/914651","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411471","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411471/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103048","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T00:16:35.133","lastModified":"2026-10-01T19:17:17.920","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.\n\nThis issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Collection extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/Collection/+/refs/heads/master","versions":[{"version":"0","lessThan":"1.46.1, 1.45.5, 1.43.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:32:23.478420Z","id":"CVE-2026-103048","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/1346083","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T321092","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103049","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T00:16:35.253","lastModified":"2026-09-30T21:17:08.113","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS.\n\nThis issue affects Mediawiki - Cargo extension: before 1.46.1."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/Cargo/+/refs/heads/master","versions":[{"version":"0","lessThan":"1.46.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T20:01:09.530452Z","id":"CVE-2026-103049","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1310132","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T431567","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103050","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T00:16:35.370","lastModified":"2026-09-30T21:17:08.270","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS.\n\nThis issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - MassMessage extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/MassMessage/+/refs/heads/master","versions":[{"version":"0","lessThan":"1.46.1, 1.45.5, 1.43.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:14:37.088220Z","id":"CVE-2026-103050","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/1346089","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T432341","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103051","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T00:16:35.473","lastModified":"2026-09-30T21:17:08.430","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS.\n\nThis issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - CentralNotice extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CentralNotice/+/refs/heads/master","versions":[{"version":"0","lessThan":"1.46.1, 1.45.5, 1.43.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:14:10.990416Z","id":"CVE-2026-103051","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralNotice/+/1346103","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T432419","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-13046","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:35.593","lastModified":"2026-10-08T20:01:01.740","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["EUCC"],"versions":[{"version":"12.11","lessThan":"12.11.10","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-13046","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.11.10","matchCriteriaId":"D0DD89C8-5529-4BDA-8F9A-42CBD7BCB84F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-13046","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-13224","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:35.733","lastModified":"2026-10-08T19:59:13.960","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:24:06.850365Z","id":"CVE-2026-13224","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-23"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-13224","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18105","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:35.877","lastModified":"2026-10-08T19:57:14.673","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:39:25.311470Z","id":"CVE-2026-18105","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-18105","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18145","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:36.003","lastModified":"2026-10-08T19:48:38.593","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-18145","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.2","versionEndExcluding":"2026.2.3","matchCriteriaId":"39259735-5AB8-48A4-9886-7C469DD3F469"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-18145","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81433","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:36.150","lastModified":"2026-10-01T04:18:20.963","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-81433","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-120"},{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-81433","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3"}]}},{"cve":{"id":"CVE-2026-86101","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:36.283","lastModified":"2026-10-08T19:40:03.017","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:22:36.042789Z","id":"CVE-2026-86101","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-86101","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86104","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:36.420","lastModified":"2026-10-06T20:49:44.270","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:22:18.509930Z","id":"CVE-2026-86104","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-409"},{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-86104","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86105","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:36.550","lastModified":"2026-10-06T20:47:02.657","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to access."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:39:57.813731Z","id":"CVE-2026-86105","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-176"},{"lang":"en","value":"CWE-285"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-86105","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86128","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:36.687","lastModified":"2026-10-06T20:42:54.507","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:41:55.331980Z","id":"CVE-2026-86128","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-86128","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86131","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:36.817","lastModified":"2026-10-06T20:39:54.950","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T03:55:39.882228Z","id":"CVE-2026-86131","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-295"},{"lang":"en","value":"CWE-829"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-86131","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86132","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:36.957","lastModified":"2026-10-06T20:36:46.633","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:42:16.853692Z","id":"CVE-2026-86132","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-86132","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86133","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:37.087","lastModified":"2026-10-06T20:28:50.903","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:24:20.379997Z","id":"CVE-2026-86133","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-191"},{"lang":"en","value":"CWE-1284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-86133","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86136","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:37.213","lastModified":"2026-10-06T20:22:36.410","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.0","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:42:26.667301Z","id":"CVE-2026-86136","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-476"},{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-86136","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-90441","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T00:16:37.363","lastModified":"2026-10-06T20:02:48.830","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:24:32.902066Z","id":"CVE-2026-90441","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-90441","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102804","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T01:16:35.990","lastModified":"2026-10-02T13:17:23.053","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave.h. Performing a manipulation of the argument width/oversample results in integer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Nothings","product":"stb","cpes":["cpe:2.3:a:nothings:stb:*:*:*:*:*:*:*:*"],"versions":[{"version":"2c980bb59875b0d32144a71867fbdebb2f77cd20","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:43:11.144226Z","id":"CVE-2026-102804","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-189"},{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/nothings/stb/","source":"cna@vuldb.com"},{"url":"https://github.com/nothings/stb/issues/1961","source":"cna@vuldb.com"},{"url":"https://github.com/user-attachments/files/31351618/poc_hexwave.c","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102804","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/944861","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411496","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411496/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102805","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T01:16:36.187","lastModified":"2026-10-01T16:17:35.400","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library stb_image_write.h of the component Image Encoding. Executing a manipulation can lead to integer overflow. The attack can be executed remotely. The exploit has been published and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Nothings","product":"stb","cpes":["cpe:2.3:a:nothings:stb:*:*:*:*:*:*:*:*"],"modules":["Image Encoding"],"versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"},{"version":"1.2","status":"affected"},{"version":"1.3","status":"affected"},{"version":"1.4","status":"affected"},{"version":"1.5","status":"affected"},{"version":"1.6","status":"affected"},{"version":"1.7","status":"affected"},{"version":"1.8","status":"affected"},{"version":"1.9","status":"affected"},{"version":"1.10","status":"affected"},{"version":"1.11","status":"affected"},{"version":"1.12","status":"affected"},{"version":"1.13","status":"affected"},{"version":"1.14","status":"affected"},{"version":"1.15","status":"affected"},{"version":"1.16","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:11:06.275086Z","id":"CVE-2026-102805","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-189"},{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/nothings/stb/","source":"cna@vuldb.com"},{"url":"https://github.com/nothings/stb/issues/1964","source":"cna@vuldb.com"},{"url":"https://github.com/nothings/stb/issues/1964#issuecomment-5404606996","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102805","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/944868","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411497","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411497/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102842","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T01:16:36.373","lastModified":"2026-09-30T14:17:24.813","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_user_login_model.php::cekUserLogin of the file application/models/app_user_login_model.php of the component KCFinder File Manager. Such manipulation of the argument ADMIN_RS_KCFINDER leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"gedelumbung","product":"HospitalManagement","cpes":["cpe:2.3:a:gedelumbung:hospitalmanagement:*:*:*:*:*:*:*:*"],"modules":["KCFinder File Manager"],"versions":[{"version":"c2d45543789a3887067d3915f69d44cfc2cf76a8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:55:53.103904Z","id":"CVE-2026-102842","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/gedelumbung/HospitalManagement/","source":"cna@vuldb.com"},{"url":"https://github.com/gedelumbung/HospitalManagement/issues/8","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102842","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/946238","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411501","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411501/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103053","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T01:16:36.563","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"beenuar","product":"AiSOC","defaultStatus":"unaffected","repo":"https://github.com/beenuar/AiSOC","versions":[{"version":"9.0.0","lessThan":"12.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:57:32.727782Z","id":"CVE-2026-103053","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/security/authz.py#L104-L121","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/releases/tag/v12.0.0","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/security/advisories/GHSA-g4h7-p63q-r8r4","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/aisoc-9.0.0-before-12.0.0-missing-authentication-on-actions-service-response-action-api","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/security/advisories/GHSA-g4h7-p63q-r8r4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103054","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T01:16:36.727","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the add_tenants_to_portfolio endpoint to claim unclaimed tenants and read their security alerts, incidents, and posture metrics without consent."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"beenuar","product":"AiSOC","defaultStatus":"unaffected","repo":"https://github.com/beenuar/AiSOC","versions":[{"version":"10.0.0","lessThan":"12.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:56:27.170536Z","id":"CVE-2026-103054","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/beenuar/AiSOC/blob/v11.2.0/services/api/app/api/v1/endpoints/mssp.py#L1073-L1110","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/commit/151264a8b846db55099e5e0f4d76c388e8df4a92","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/releases/tag/v12.0.0","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/security/advisories/GHSA-mcg9-8pxf-j98v","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/aisoc-10.0.0-before-12.0.0-unauthorized-tenant-access-via-mssp","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/security/advisories/GHSA-mcg9-8pxf-j98v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103055","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T01:16:36.880","lastModified":"2026-10-02T13:17:38.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access cross-tenant live alerts, cases, agent events and graph updates through the realtime endpoints."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"beenuar","product":"AiSOC","defaultStatus":"unaffected","repo":"https://github.com/beenuar/AiSOC","versions":[{"version":"7.5.0","lessThan":"12.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:45:28.268781Z","id":"CVE-2026-103055","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://github.com/beenuar/AiSOC/blob/v11.2.0/services/realtime/src/auth.ts#L51-L59","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/commit/2f0e954f2febecb3720e6eadb017546c5d121c43","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/releases/tag/v12.0.0","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/security/advisories/GHSA-4m55-xhcm-wjcr","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/aisoc-7.5.0-before-12.0.0-authentication-bypass-via-hard-coded-jwt-secret","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/security/advisories/GHSA-4m55-xhcm-wjcr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103056","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T01:16:37.050","lastModified":"2026-09-30T19:16:38.833","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"beenuar","product":"AiSOC","defaultStatus":"unaffected","repo":"https://github.com/beenuar/AiSOC","versions":[{"version":"7.2.0","lessThan":"12.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:02:45.621861Z","id":"CVE-2026-103056","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/clients/crowdstrike_rtr.py#L273","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/executors/endpoint.py#L442","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/releases/tag/v12.0.0","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/security/advisories/GHSA-7q37-2wfw-xrx7","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/aisoc-7.2.0-before-12.0.0-command-injection-via-crowdstrike-rtr","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/security/advisories/GHSA-7q37-2wfw-xrx7","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103057","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T01:16:37.217","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"beenuar","product":"AiSOC","defaultStatus":"unaffected","repo":"https://github.com/beenuar/AiSOC","versions":[{"version":"5.1.0","lessThan":"12.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:56:33.984674Z","id":"CVE-2026-103057","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/beenuar/AiSOC/blob/v11.2.0/services/realtime/src/index.ts#L681-L691","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/commit/2f0e954f2febecb3720e6eadb017546c5d121c43","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/releases/tag/v12.0.0","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/aisoc-5.1.0-before-12.0.0-missing-authentication-on-realtime-service-internal-endpoints","source":"disclosure@vulncheck.com"},{"url":"https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51936","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T01:16:37.520","lastModified":"2026-10-02T13:17:50.493","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attached database into another. It is most often used to convert between plaintext and encrypted databases. It needs to do dynamic schema manipulation, and thus the function temporarily clears defensive restrictions during operation. A vulnerability in the handling of the source database name parameter made it possible for a caller to supply a crafted source name, which could execute statements that defensive mode would otherwise block. This could allow direct modifications to the sqlite_schema table and database corruption. SQLCipher 4.15.0 now strictly validates the source database name and prevents the bypass."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Zetetic","product":"SQLCipher","defaultStatus":"unaffected","platforms":["Windows","Linux","iOS","Android","MacOS"],"repo":"https://github.com/sqlcipher/sqlcipher","versions":[{"version":"0","lessThan":"4.15.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:47:15.875818Z","id":"CVE-2026-51936","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/sqlcipher/sqlcipher/commit/30842cda35c88cdfc7a8adba1c9b20821d2c08d1","source":"cve@mitre.org"},{"url":"https://www.zetetic.net/blog/2026/04/28/sqlcipher-4.15.0-release/","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-102843","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T02:16:56.117","lastModified":"2026-10-02T13:17:28.823","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/data_galeri.php of the component Endpoint. Performing a manipulation of the argument gbr results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"gedelumbung","product":"HospitalManagement","cpes":["cpe:2.3:a:gedelumbung:hospitalmanagement:*:*:*:*:*:*:*:*"],"modules":["Endpoint"],"versions":[{"version":"c2d45543789a3887067d3915f69d44cfc2cf76a8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:48:13.575964Z","id":"CVE-2026-102843","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/gedelumbung/HospitalManagement/","source":"cna@vuldb.com"},{"url":"https://github.com/gedelumbung/HospitalManagement/issues/9","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102843","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/946239","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411502","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411502/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102844","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T02:16:56.303","lastModified":"2026-09-30T18:18:15.013","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporan_data_pasien.php. Executing a manipulation of the argument id_param can lead to authorization bypass. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"gedelumbung","product":"HospitalManagement","cpes":["cpe:2.3:a:gedelumbung:hospitalmanagement:*:*:*:*:*:*:*:*"],"versions":[{"version":"c2d45543789a3887067d3915f69d44cfc2cf76a8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:N/A:N","baseScore":3.3,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.4,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:12:04.100432Z","id":"CVE-2026-102844","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/gedelumbung/HospitalManagement/","source":"cna@vuldb.com"},{"url":"https://github.com/gedelumbung/HospitalManagement/issues/10","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102844","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/946240","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411503","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411503/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102845","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T02:16:56.490","lastModified":"2026-09-30T14:17:24.987","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function error_reporting of the file index.php of the component HTTP Response. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"gedelumbung","product":"HospitalManagement","cpes":["cpe:2.3:a:gedelumbung:hospitalmanagement:*:*:*:*:*:*:*:*"],"modules":["HTTP Response"],"versions":[{"version":"c2d45543789a3887067d3915f69d44cfc2cf76a8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:55:25.981320Z","id":"CVE-2026-102845","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/gedelumbung/HospitalManagement/","source":"cna@vuldb.com"},{"url":"https://github.com/gedelumbung/HospitalManagement/issues/11","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102845","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/946241","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411504","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411504/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102846","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T02:16:56.673","lastModified":"2026-10-02T13:17:30.093","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/content_setting results in improper authorization. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"gedelumbung","product":"HospitalManagement","cpes":["cpe:2.3:a:gedelumbung:hospitalmanagement:*:*:*:*:*:*:*:*"],"modules":["Configuration Handler"],"versions":[{"version":"c2d45543789a3887067d3915f69d44cfc2cf76a8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:49:17.079478Z","id":"CVE-2026-102846","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/gedelumbung/HospitalManagement/","source":"cna@vuldb.com"},{"url":"https://github.com/gedelumbung/HospitalManagement/issues/12","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102846","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/946242","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411505","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411505/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102847","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T02:16:56.857","lastModified":"2026-09-30T18:18:15.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku_tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"gedelumbung","product":"HospitalManagement","cpes":["cpe:2.3:a:gedelumbung:hospitalmanagement:*:*:*:*:*:*:*:*"],"modules":["Guest Book"],"versions":[{"version":"c2d45543789a3887067d3915f69d44cfc2cf76a8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:10:40.918465Z","id":"CVE-2026-102847","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/gedelumbung/HospitalManagement/","source":"cna@vuldb.com"},{"url":"https://github.com/gedelumbung/HospitalManagement/issues/13","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102847","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/946243","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411506","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411506/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103087","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T02:16:57.043","lastModified":"2026-09-30T20:17:28.840","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (stack exhaustion and application crash) via an SVG document containing an excessive number of deeply nested elements. Because the engine does not limit the nesting depth of processed SVG nodes, rendering such a document overflows the thread stack and terminates the application. The malicious SVG can be embedded through the SRC attribute of an IMG element, and thus exploitation only requires the victim to visit an attacker-controlled web page."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"gosub-io","product":"gosub-engine","defaultStatus":"unaffected","repo":"https://github.com/gosub-io/gosub-engine","versions":[{"version":"0","lessThan":"46868b3deae44544bee2a13e756772966dde950e","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:50:01.779392Z","id":"CVE-2026-103087","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/gosub-io/gosub-engine/pull/1229","source":"cve@mitre.org"},{"url":"https://github.com/gosub-io/gosub-engine/security/advisories/GHSA-c762-mxfh-vwvp","source":"cve@mitre.org"},{"url":"https://github.com/gosub-io/gosub-engine/security/advisories/GHSA-c762-mxfh-vwvp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103088","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T02:16:57.203","lastModified":"2026-09-30T18:18:15.493","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment and reads files outside the configured template base directory."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"jknack","product":"handlebars.java","defaultStatus":"unaffected","repo":"https://github.com/jknack/handlebars.java","packageURL":"pkg:maven/com.github.jknack/handlebars-springmvc","versions":[{"version":"4.5.3","lessThan":"4.5.5","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:13:35.282546Z","id":"CVE-2026-103088","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-24"}]}],"references":[{"url":"https://github.com/jknack/handlebars.java/commit/f6ae3979917d05bef07f00befb4013ef00503660","source":"cve@mitre.org"},{"url":"https://github.com/jknack/handlebars.java/releases/tag/v4.5.5","source":"cve@mitre.org"},{"url":"https://github.com/jknack/handlebars.java/security/advisories/GHSA-pvrx-3g7m-fpgv","source":"cve@mitre.org"},{"url":"https://github.com/jknack/handlebars.java/security/advisories/GHSA-pvrx-3g7m-fpgv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-78229","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T02:16:57.583","lastModified":"2026-09-30T16:47:57.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"PFU Limited","product":"Image Scanner Driver for Linux (fi Series)","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected"},{"version":"2.1.0","lessThanOrEqual":"2.1.1","versionType":"semver","status":"affected"},{"version":"2.3.2","status":"affected"},{"version":"2.5.0","status":"affected"},{"version":"2.7.0","lessThanOrEqual":"2.7.1","versionType":"semver","status":"affected"},{"version":"2.8.0","lessThanOrEqual":"2.8.2","versionType":"semver","status":"affected"}]},{"vendor":"PFU Limited","product":"Image Scanner Driver for Linux (SP Series)","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected"},{"version":"2.1.0","lessThanOrEqual":"2.1.1-4","versionType":"semver","status":"affected"},{"version":"2.2.0","lessThanOrEqual":"2.2.2","versionType":"semver","status":"affected"},{"version":"2.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:57:11.023085Z","id":"CVE-2026-78229","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://jvn.jp/en/vu/JVNVU96968110/","source":"vultures@jpcert.or.jp"},{"url":"https://www.pfu.ricoh.com/global/products_security/vul2026000001e.html","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-81310","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T02:16:57.747","lastModified":"2026-09-30T17:16:50.353","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"PFU Limited","product":"Image Scanner Driver for Linux (fi Series)","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected"},{"version":"2.1.0","lessThanOrEqual":"2.1.1","versionType":"semver","status":"affected"},{"version":"2.3.2","status":"affected"},{"version":"2.5.0","status":"affected"},{"version":"2.7.0","lessThanOrEqual":"2.7.1","versionType":"semver","status":"affected"},{"version":"2.8.0","lessThanOrEqual":"2.8.2","versionType":"semver","status":"affected"}]},{"vendor":"PFU Limited","product":"Image Scanner Driver for Linux (SP Series)","defaultStatus":"unaffected","versions":[{"version":"2.0.0","status":"affected"},{"version":"2.1.0","lessThanOrEqual":"2.1.1-4","versionType":"semver","status":"affected"},{"version":"2.2.0","lessThanOrEqual":"2.2.2","versionType":"semver","status":"affected"},{"version":"2.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:57:00.957114Z","id":"CVE-2026-81310","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://jvn.jp/en/vu/JVNVU96968110/","source":"vultures@jpcert.or.jp"},{"url":"https://www.pfu.ricoh.com/global/products_security/vul2026000001e.html","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-102874","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T03:16:57.503","lastModified":"2026-09-30T14:17:25.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"HKUDS","product":"AnyTool","cpes":["cpe:2.3:a:hkuds:anytool:*:*:*:*:*:*:*:*"],"modules":["Execute Endpoint"],"versions":[{"version":"0.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:54:20.433665Z","id":"CVE-2026-102874","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/HKUDS/AnyTool/","source":"cna@vuldb.com"},{"url":"https://github.com/HKUDS/AnyTool/issues/6","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102874","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/949780","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411510","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411510/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102906","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T03:16:58.150","lastModified":"2026-10-02T13:17:32.003","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child_process.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"0xshariq","product":"github-mcp-server","cpes":["cpe:2.3:a:0xshariq:github-mcp-server:*:*:*:*:*:*:*:*"],"modules":["Git Remove MCP Tool"],"versions":[{"version":"52e764a7d66eac1726fce02ca7bb5a638571801a","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:51:47.010671Z","id":"CVE-2026-102906","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/0xshariq/github-mcp-server/","source":"cna@vuldb.com"},{"url":"https://github.com/0xshariq/github-mcp-server/issues/2","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102906","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953767","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411537","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411537/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102908","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T03:16:58.350","lastModified":"2026-09-30T18:18:15.327","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/examproper/questions-view.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:58:38.888237Z","id":"CVE-2026-102908","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/Aszadom/cve/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102908","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953892","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411581","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411581/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102909","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T03:16:58.537","lastModified":"2026-09-30T14:17:25.810","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/examproper/btn_functions.php. The manipulation of the argument access_code leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:52:38.884343Z","id":"CVE-2026-102909","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/Aszadom/cve/issues/2","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102909","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953896","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411582","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411582/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103099","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T03:16:58.717","lastModified":"2026-10-06T20:00:02.837","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Pexip","product":"Infinity","defaultStatus":"unaffected","versions":[{"version":"18.0.0","lessThan":"41.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:54:47.734475Z","id":"CVE-2026-103099","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-617"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionEndExcluding":"41.1","matchCriteriaId":"A12E3BFB-F652-4829-BB50-DB531F821949"}]}]}],"references":[{"url":"https://docs.pexip.com/admin/security_bulletins.htm","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103100","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T03:16:58.870","lastModified":"2026-10-05T20:54:09.630","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a software abort resulting in a denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Pexip","product":"Infinity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"40.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:50:07.991163Z","id":"CVE-2026-103100","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-617"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionEndExcluding":"40.1","matchCriteriaId":"603AF15F-BE1D-4350-B5E4-2961BB0F5858"}]}]}],"references":[{"url":"https://docs.pexip.com/admin/security_bulletins.htm","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103101","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T03:16:59.033","lastModified":"2026-10-05T20:53:51.977","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Pexip","product":"Infinity","defaultStatus":"unaffected","versions":[{"version":"30.0.0","lessThan":"41.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:48:35.639920Z","id":"CVE-2026-103101","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionStartIncluding":"30.0","versionEndExcluding":"41.0","matchCriteriaId":"9A6A27BA-880B-4A03-9796-8407A3FFCBC2"}]}]}],"references":[{"url":"https://docs.pexip.com/admin/security_bulletins.htm","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103102","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T03:16:59.307","lastModified":"2026-10-05T20:48:51.707","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort resulting in a denial of service. Exploitation of this issue requires accessing a gateway call from a WebRTC/API client."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Pexip","product":"Infinity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"41.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:09:21.789730Z","id":"CVE-2026-103102","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionEndExcluding":"41.0","matchCriteriaId":"4CFF7637-1AA0-4162-AEDE-353BE8AB7FF2"}]}]}],"references":[{"url":"https://docs.pexip.com/admin/security_bulletins.htm","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103104","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T03:16:59.467","lastModified":"2026-10-05T20:45:28.407","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to trigger a software abort resulting in a denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Pexip","product":"Infinity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"38.2.0","versionType":"semver","status":"affected"},{"version":"39.0.0","versionType":"semver","status":"affected"},{"version":"39.1.0","versionType":"semver","status":"affected"},{"version":"40.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:53:38.865779Z","id":"CVE-2026-103104","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-617"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionEndExcluding":"38.2","matchCriteriaId":"DFD7712D-CD23-4418-BBDA-006D51921999"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionStartIncluding":"39.0","versionEndIncluding":"39.1","matchCriteriaId":"4DD39F66-4440-45B3-9400-3297C4201ECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:40.0:*:*:*:*:*:*:*","matchCriteriaId":"64CD3049-810D-4C5C-BD91-86A61EECAE8A"}]}]}],"references":[{"url":"https://docs.pexip.com/admin/security_bulletins.htm","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103105","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T03:16:59.623","lastModified":"2026-10-05T20:44:01.657","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Pexip","product":"Infinity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"38.2.0","versionType":"semver","status":"affected"},{"version":"39.0.0","versionType":"semver","status":"affected"},{"version":"39.1.0","versionType":"semver","status":"affected"},{"version":"40.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:52:34.392027Z","id":"CVE-2026-103105","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionEndExcluding":"38.2","matchCriteriaId":"DFD7712D-CD23-4418-BBDA-006D51921999"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionStartIncluding":"39.0","versionEndIncluding":"39.1","matchCriteriaId":"4DD39F66-4440-45B3-9400-3297C4201ECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:40.0:*:*:*:*:*:*:*","matchCriteriaId":"64CD3049-810D-4C5C-BD91-86A61EECAE8A"}]}]}],"references":[{"url":"https://docs.pexip.com/admin/security_bulletins.htm","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103106","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T03:16:59.773","lastModified":"2026-10-05T20:24:57.777","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with local access to escalate privileges to root. Exploitation requires an attacker to be able to run arbitrary code on a node by either achieving remote code execution via some other vulnerability or having administrative access to the operating system."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Pexip","product":"Infinity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"38.2.0","versionType":"semver","status":"affected"},{"version":"39.0.0","versionType":"semver","status":"affected"},{"version":"39.1.0","versionType":"semver","status":"affected"},{"version":"40.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:46:28.832384Z","id":"CVE-2026-103106","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-669"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionEndExcluding":"38.2","matchCriteriaId":"DFD7712D-CD23-4418-BBDA-006D51921999"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionStartIncluding":"39.0","versionEndIncluding":"39.1","matchCriteriaId":"4DD39F66-4440-45B3-9400-3297C4201ECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:40.0:*:*:*:*:*:*:*","matchCriteriaId":"64CD3049-810D-4C5C-BD91-86A61EECAE8A"}]}]}],"references":[{"url":"https://docs.pexip.com/admin/security_bulletins.htm","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103108","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T03:16:59.920","lastModified":"2026-10-05T20:24:36.650","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Pexip","product":"Infinity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"38.2.0","versionType":"semver","status":"affected"},{"version":"39.0.0","versionType":"semver","status":"affected"},{"version":"39.1.0","versionType":"semver","status":"affected"},{"version":"40.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:54:21.878599Z","id":"CVE-2026-103108","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-617"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionEndExcluding":"38.2","matchCriteriaId":"DFD7712D-CD23-4418-BBDA-006D51921999"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionStartIncluding":"39.0","versionEndIncluding":"39.1","matchCriteriaId":"4DD39F66-4440-45B3-9400-3297C4201ECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:40.0:*:*:*:*:*:*:*","matchCriteriaId":"64CD3049-810D-4C5C-BD91-86A61EECAE8A"}]}]}],"references":[{"url":"https://docs.pexip.com/admin/security_bulletins.htm","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103109","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T03:17:00.073","lastModified":"2026-10-05T20:24:21.067","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort during processing, and has the potential to achieve memory corruption."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Pexip","product":"Infinity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"38.2.0","versionType":"semver","status":"affected"},{"version":"39.0.0","versionType":"semver","status":"affected"},{"version":"39.1.0","versionType":"semver","status":"affected"},{"version":"40.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:53:09.084413Z","id":"CVE-2026-103109","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionEndExcluding":"38.2","matchCriteriaId":"DFD7712D-CD23-4418-BBDA-006D51921999"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionStartIncluding":"39.0","versionEndIncluding":"39.1","matchCriteriaId":"4DD39F66-4440-45B3-9400-3297C4201ECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:40.0:*:*:*:*:*:*:*","matchCriteriaId":"64CD3049-810D-4C5C-BD91-86A61EECAE8A"}]}]}],"references":[{"url":"https://docs.pexip.com/admin/security_bulletins.htm","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86556","sourceIdentifier":"psirt@zte.com.cn","published":"2026-09-30T03:17:00.237","lastModified":"2026-09-30T16:29:22.650","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information."}],"affected":[{"source":"psirt@zte.com.cn","affectedData":[{"vendor":"ZTE","product":"U30 Air","defaultStatus":"unaffected","versions":[{"version":"U30AirV1.0.0B31 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@zte.com.cn","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:37:44.482937Z","id":"CVE-2026-86556","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@zte.com.cn","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/3351503523831148854","source":"psirt@zte.com.cn"}]}},{"cve":{"id":"CVE-2026-96649","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T03:17:00.387","lastModified":"2026-09-30T16:19:26.133","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site operator to have enabled guest post submission via the [fpsm] shortcode, which registers a publicly accessible AJAX handler gated only by a nonce emitted on every page containing the shortcode."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpshuffle","product":"Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.3.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:55:27.524882Z","id":"CVE-2026-96649","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/assets/js/fpsml-fileuploader.js#L578","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/assets/js/fpsml-fileuploader.js#L583","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/assets/js/fpsml-frontend.js#L40","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/includes/classes/class-fpsml-library.php#L112","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/includes/cores/ajax-process-form.php#L161","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.4/includes/cores/ajax-process-form.php#L5","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.3.5/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0af8ff06-68e2-4a0c-9de4-d06a6a2e86c9?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-102910","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T04:18:27.613","lastModified":"2026-10-02T13:17:32.963","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument test_id results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:54:03.366089Z","id":"CVE-2026-102910","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/Aszadom/cve/issues/3","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102910","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953899","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411583","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411583/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102911","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T04:18:28.580","lastModified":"2026-09-30T17:16:41.040","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 0.11.8 is able to address this issue. This patch is called 360867034e79175b45c8e04a98e4ca712bbaca35. Upgrading the affected component is advised."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"zosmaai","product":"pi-llm-wiki","cpes":["cpe:2.3:a:zosmaai:pi-llm-wiki:*:*:*:*:*:*:*:*"],"modules":["wiki_capture_source MCP tool"],"versions":[{"version":"0.11.0","status":"affected"},{"version":"0.11.1","status":"affected"},{"version":"0.11.2","status":"affected"},{"version":"0.11.3","status":"affected"},{"version":"0.11.4","status":"affected"},{"version":"0.11.5","status":"affected"},{"version":"0.11.6","status":"affected"},{"version":"0.11.7","status":"affected"},{"version":"0.11.8","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:53:08.171233Z","id":"CVE-2026-102911","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/zosmaai/pi-llm-wiki/","source":"cna@vuldb.com"},{"url":"https://github.com/zosmaai/pi-llm-wiki/commit/360867034e79175b45c8e04a98e4ca712bbaca35","source":"cna@vuldb.com"},{"url":"https://github.com/zosmaai/pi-llm-wiki/issues/185","source":"cna@vuldb.com"},{"url":"https://github.com/zosmaai/pi-llm-wiki/pull/186","source":"cna@vuldb.com"},{"url":"https://github.com/zosmaai/pi-llm-wiki/releases/tag/v0.11.8","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102911","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953898","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411587","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411587/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-102912","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T04:18:28.850","lastModified":"2026-09-30T14:17:25.987","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument date_start/date_end leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Leave Management System","cpes":["cpe:2.3:a:sourcecodester:online_leave_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:52:08.651724Z","id":"CVE-2026-102912","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/zhongzhicong1998/CVE/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102912","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/954023","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411636","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411636/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103110","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T04:18:29.077","lastModified":"2026-10-05T20:20:44.153","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Pexip","product":"Infinity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"38.2.0","versionType":"semver","status":"affected"},{"version":"39.0.0","versionType":"semver","status":"affected"},{"version":"39.1.0","versionType":"semver","status":"affected"},{"version":"40.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:53:09.564046Z","id":"CVE-2026-103110","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionEndExcluding":"38.2","matchCriteriaId":"DFD7712D-CD23-4418-BBDA-006D51921999"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*","versionStartIncluding":"39.0","versionEndIncluding":"39.1","matchCriteriaId":"4DD39F66-4440-45B3-9400-3297C4201ECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:pexip:pexip_infinity:40.0:*:*:*:*:*:*:*","matchCriteriaId":"64CD3049-810D-4C5C-BD91-86A61EECAE8A"}]}]}],"references":[{"url":"https://docs.pexip.com/admin/security_bulletins.htm","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86134","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-30T04:18:33.337","lastModified":"2026-10-06T17:30:29.910","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["Default"],"versions":[{"version":"2026.3","lessThan":"2026.3.2","versionType":"custom","status":"affected"},{"version":"2025.0","lessThan":"2026.2.3","versionType":"custom","status":"affected"},{"version":"12.0","lessThan":"12.12.3","versionType":"custom","status":"affected"}]},{"vendor":"WatchGuard","product":"Fireware OS","defaultStatus":"unaffected","platforms":["T15/T35"],"versions":[{"version":"12.0","lessThan":"12.5.21","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:38:22.384700Z","id":"CVE-2026-86134","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.0","versionEndExcluding":"12.5.21","matchCriteriaId":"C618D05C-B8A0-4912-B87E-B67A0686C14D"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"12.12","versionEndExcluding":"12.12.3","matchCriteriaId":"684B81A6-0CE5-4424-A38A-FE989C790E7F"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.0","versionEndExcluding":"2026.2.3","matchCriteriaId":"9F11812A-FDA8-401D-871B-219DFDADEDC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.3","versionEndExcluding":"2026.3.2","matchCriteriaId":"525833A2-ABEC-4C06-BE1B-6A5E64A21775"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-86134","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102913","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T05:16:44.160","lastModified":"2026-10-02T13:17:34.363","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_enrollment. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Car Driving School Management System","cpes":["cpe:2.3:a:sourcecodester:car_driving_school_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:55:58.360884Z","id":"CVE-2026-102913","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/zhongzhicong1998/CVE/issues/2","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-102913","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/954038","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411637","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411637/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103111","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T05:16:45.863","lastModified":"2026-10-04T00:16:35.563","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"PCRE","product":"PCRE2","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.49","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:44:17.818308Z","id":"CVE-2026-103111","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-100143","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:16:58.743","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The FluentCart A New Era of eCommerce  WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer's stored record."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"FluentCart A New Era of eCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.6.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:28:53.590135Z","id":"CVE-2026-100143","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/86c69e28-bdd2-4027-a045-f8b2523f8d7f/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-75823","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:03.783","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The User Frontend  WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor.\n\nThis affects installations running a PHP build where the sodium extension is unavailable, and where a registration page has been configured. The administrator role cannot be obtained this way."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"User Frontend","defaultStatus":"unaffected","versions":[{"version":"3.5.29","lessThan":"4.3.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:28:42.968624Z","id":"CVE-2026-75823","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://wpscan.com/vulnerability/4a385690-3471-4604-aa2a-e120bb31ca53/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-75824","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:04.360","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The User Frontend  WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled.\n\nThe created account receives the site's default role."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"User Frontend","defaultStatus":"unaffected","versions":[{"version":"2.5.8","lessThan":"4.3.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:28:22.792398Z","id":"CVE-2026-75824","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/61b04ece-5050-465e-aa11-de2ff79c6e8c/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-75873","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:04.670","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Zella Theme","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.6.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:27:25.773310Z","id":"CVE-2026-75873","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://wpscan.com/vulnerability/15b8a6cb-f89c-4d4d-9812-441e822c647f/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-80333","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:05.003","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Solace Extra","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.7.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:26:41.641388Z","id":"CVE-2026-80333","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/2baffcd4-686e-40db-96b3-5abc70a03a5f/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-82127","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:05.353","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfiltered_html capability."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Schema & Structured Data for WP & AMP","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.67","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:26:30.649731Z","id":"CVE-2026-82127","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/fa992935-6764-407e-a95f-31c55c33bf38/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-83560","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:05.673","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"New User Approve","defaultStatus":"unaffected","versions":[{"version":"3.1.0","lessThan":"3.2.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:26:20.977481Z","id":"CVE-2026-83560","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/dc48141c-c7d3-485e-9470-88f5e24a701f/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-85001","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:05.957","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The EmbedPress  WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"EmbedPress","defaultStatus":"unaffected","versions":[{"version":"4.4.9","lessThan":"4.6.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:26:02.608935Z","id":"CVE-2026-85001","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/889be882-342b-4331-89c5-9eebe90d3704/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-85415","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:06.203","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Audio Player Block  WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link (such as an administrator or editor reviewing the post)."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Audio Player Block","defaultStatus":"unaffected","versions":[{"version":"1.1.0","lessThan":"1.6.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:25:30.309228Z","id":"CVE-2026-85415","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/3ca9c087-311b-4c55-8871-fba318f654b3/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-85573","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:06.503","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"All in One Files Upload","defaultStatus":"unaffected","versions":[{"version":"2.0.3","lessThan":"2.0.17","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:24:59.209826Z","id":"CVE-2026-85573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0f7f1f25-02e2-49b5-9690-31857e9e6bda/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-85576","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:06.793","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"All in One Files Upload","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.17","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:24:48.398755Z","id":"CVE-2026-85576","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5c4546f4-fa6f-47a5-9d2b-9493d34dc13d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86789","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:07.067","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending moderation, including entry names, organizations, biographies, internal notes and street addresses.\nThe Connections Business Directory WordPress plugin through 10.4.67 has been closed on WordPress.org and no fixed version is available, so site owners should remove it or restrict unauthenticated access to its REST API routes."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Connections Business Directory","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"10.4.67","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:24:40.259436Z","id":"CVE-2026-86789","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/3514e2f9-4dda-45ae-80c0-c7caafcb7d8a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87777","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:07.387","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Hostinger Reach  WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens the affected content in the editor."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Hostinger Reach","defaultStatus":"unaffected","versions":[{"version":"1.0.6","lessThan":"1.8.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:24:30.747031Z","id":"CVE-2026-87777","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/4a1f5c2b-a6e5-4e6f-afa3-79726d0eb1e3/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88791","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:07.690","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Safe Redirect Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N","baseScore":3.4,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:24:20.580965Z","id":"CVE-2026-88791","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a8aa5685-e36e-4e1f-a259-fab3910ee550/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88797","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:07.977","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any  hosted on the WordPress.org repository."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Vayu X","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:24:12.248142Z","id":"CVE-2026-88797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/250a7d7c-9c9b-4619-a6f4-533d29a30e23/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89190","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:08.280","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Robin Image Optimizer  WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer  WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer  WordPress plugin before 2.0.8's stored settings."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Robin Image Optimizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:23:57.765416Z","id":"CVE-2026-89190","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/570e6bfb-cfe9-4a6f-8759-c6e99e19e272/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89193","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:08.590","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Robin Image Optimizer  WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Robin Image Optimizer","defaultStatus":"unaffected","versions":[{"version":"2.0.0","lessThan":"2.0.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:23:49.210519Z","id":"CVE-2026-89193","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/3c90d1c5-fd45-4a82-9357-504d7a0e5adc/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-90953","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:08.883","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Image Optimizer  WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Image Optimizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.7.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:23:39.901346Z","id":"CVE-2026-90953","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/38412622-513f-41ea-9968-192f357d360e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-91051","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:09.173","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or ."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"EWWW Image Optimizer","defaultStatus":"unaffected","versions":[{"version":"8.6.0","lessThan":"8.8.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:23:29.745094Z","id":"CVE-2026-91051","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://wpscan.com/vulnerability/e24a9497-8fb4-4067-8421-194725455d55/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-91072","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:09.413","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"EWWW Image Optimizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8.8.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:23:17.692335Z","id":"CVE-2026-91072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c77770c5-d1af-47f6-9aee-a50d4a919732/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-91832","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:09.593","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Mobile Menu  WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu  WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Mobile Menu","defaultStatus":"unaffected","versions":[{"version":"2.7.4","lessThan":"2.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:23:01.642060Z","id":"CVE-2026-91832","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/9f1448d5-6dc9-47dd-8675-2fbf5f36393b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-92424","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:09.793","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Content Egg  WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary web scripts unfiltered under a privileged user's account, executing in the context of anyone who later views that content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Content Egg","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"11.9.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:22:40.326257Z","id":"CVE-2026-92424","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/917b8042-b38c-4b6a-9237-1dd08ada157d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-92994","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:09.983","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the browser of any user who opens it."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Verge3D Publishing and E-Commerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.13.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:22:29.279324Z","id":"CVE-2026-92994","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/48356bf5-634f-4008-8904-10ab35007e21/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93580","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:10.160","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"InPost PL","defaultStatus":"unaffected","versions":[{"version":"1.7.5","lessThan":"1.9.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:21:20.582452Z","id":"CVE-2026-93580","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/083dab74-cffe-4532-8fc3-939a015c83d4/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-94274","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:10.367","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The YayReviews  WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"YayReviews","defaultStatus":"unaffected","versions":[{"version":"1.0.4","lessThan":"1.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:20:52.972110Z","id":"CVE-2026-94274","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/23965307-678d-4f59-beae-5a8b33af9a75/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-94297","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:10.593","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Media Library Organizer  WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Media Library Organizer","defaultStatus":"unaffected","versions":[{"version":"2.0.4","lessThan":"2.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:20:30.698730Z","id":"CVE-2026-94297","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c9cecfb4-d554-4d64-8d87-9678363d8b8d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-96886","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:10.850","lastModified":"2026-09-30T16:28:31.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Course Booking System","defaultStatus":"unaffected","versions":[{"version":"7.0","lessThan":"7.0.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:20:15.300320Z","id":"CVE-2026-96886","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/bdf459bb-7835-43d3-8ef8-83b3b099677a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-97316","sourceIdentifier":"contact@wpscan.com","published":"2026-09-30T06:17:11.137","lastModified":"2026-09-30T21:17:19.313","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Broken Link Notifier","defaultStatus":"unaffected","versions":[{"version":"1.3.1","lessThan":"2.0.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:18:27.425923Z","id":"CVE-2026-97316","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d9497ddd-c39c-4928-8660-f1c94ef2c3a0/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89294","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T07:16:30.947","lastModified":"2026-09-30T16:19:22.380","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication in practice, as the locale filter is installed unconditionally on every request during plugins_loaded and the callback performs no nonce or capability check before returning the raw GET parameter value."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"croixhaug","product":"Simply Schedule Appointments","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.6.12.27","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:55:07.481426Z","id":"CVE-2026-89294","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-98"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.27/includes/class-translation.php#L108","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.27/includes/class-translation.php#L50","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.27/includes/class-translation.php#L67","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aab8f2ae-993b-4893-81cc-1b8a1a4ef84b?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-97196","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T07:16:31.320","lastModified":"2026-09-30T14:18:14.160","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass.\n\nThis issue affects GiveWP: from n/a through 4.16.9."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Liquid Web / StellarWP","product":"GiveWP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"give","versions":[{"version":"n/a","lessThanOrEqual":"4.16.9","versionType":"custom","status":"affected","changes":[{"at":"4.17.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:51:55.528449Z","id":"CVE-2026-97196","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1289"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-9-broken-authentication-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102508","sourceIdentifier":"security@apache.org","published":"2026-09-30T08:16:31.903","lastModified":"2026-09-30T16:14:10.347","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user credential ssent by the client.\n\nThe defect manifests differently depending on the version:\n- In 0.9.0 through 0.11.0 a failed message-signature check is only logged and never enforced, and there is no mechanism to verify the server certificate: it is taken from the unauthenticated GetEndpoints discovery response and used to encrypt the user's password.\n- In 0.12.0 through 0.13.1 the signature check is inverted (valid signatures are rejected, invalid ones accepted), and server certificates are accepted without a trust anchor by default.\n- In all affected versions the default security policy is None. Starting with 0.12.0 the driver additionally continues silently at a weaker security policy than the one configured, and starting with 0.13.0 endpoint selection prefers the weakest matching endpoint.\n\nUsers checking only for one of these mechanisms may wrongly conclude they are unaffected.\n\nThis issue affects Apache PLC4X: from 0.9.0 before 1.0.0.\n\nUsers are recommended to upgrade to version 1.0.0, which fixes the issue. Version 1.0.0 verifies message signatures correctly, refuses to connect unless the server certificate can be verified against a configured trust store or pinned certificate, defaults to Basic256Sha256 with SignAndEncrypt, and fails the\nconnection if the negotiated security policy is weaker than the configured one."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache PLC4X","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.plc4x:plc4j-driver-opcua","packageURL":"pkg:maven/org.apache.plc4x/plc4j-driver-opcua","versions":[{"version":"0.9.0","lessThan":"1.0.0","versionType":"semver","status":"affected"},{"version":"1.0.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:39:20.327319Z","id":"CVE-2026-102508","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-295"},{"lang":"en","value":"CWE-347"},{"lang":"en","value":"CWE-757"}]}],"references":[{"url":"https://lists.apache.org/thread.html/o076mcnsx6wnqpdy780m7s6hddbbnjfw","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/4","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-11895","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T08:16:32.667","lastModified":"2026-09-30T16:17:10.400","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"devitemsllc","product":"HT Mega Addons for Elementor – Elementor Widgets & Template Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:55:36.277279Z","id":"CVE-2026-11895","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3583980/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4abba5ab-523c-4b4f-8d3e-bb7ee57cd280?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-14876","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T08:16:32.840","lastModified":"2026-09-30T16:17:11.480","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"nextendweb","product":"Smart Slider 3","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.5.1.38","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:54:28.163684Z","id":"CVE-2026-14876","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3654530/smart-slider-3","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d882db3-b92e-4b3b-a07e-fa30fed85364?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-16596","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T08:16:32.987","lastModified":"2026-09-30T16:17:11.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wpdirectorykit","product":"WP Directory Kit","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:53:51.397702Z","id":"CVE-2026-16596","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3626960","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7b0d55b-00c5-44ee-99a3-9d4d2b400f71?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-6170","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T08:16:33.513","lastModified":"2026-09-30T16:18:39.293","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"boldthemes","product":"Bold Page Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.7.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:53:58.100111Z","id":"CVE-2026-6170","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3526548/bold-page-builder/trunk/content_elements/bt_bb_css_image_grid/bt_bb_css_image_grid.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b359cdd-840f-4a9b-9a2f-a28e64d73819?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-6171","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T08:16:33.657","lastModified":"2026-09-30T16:18:39.423","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt_bb_icon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"boldthemes","product":"Bold Page Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.7.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:54:17.738394Z","id":"CVE-2026-6171","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3526548/bold-page-builder/trunk/content_elements/bt_bb_icon/bt_bb_icon.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74315031-8498-4ae5-bcfc-ba22af4b58dc?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-6172","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T08:16:33.800","lastModified":"2026-09-30T16:18:39.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"boldthemes","product":"Bold Page Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.7.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:54:53.879785Z","id":"CVE-2026-6172","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3526548/bold-page-builder/trunk/content_elements/bt_bb_image/bt_bb_image.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d36cad2-53ff-4515-94e3-25bc9f518070?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-6173","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T08:16:33.940","lastModified":"2026-09-30T16:18:39.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's bt_bb_section shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"boldthemes","product":"Bold Page Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.7.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:53:43.639887Z","id":"CVE-2026-6173","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3526548/bold-page-builder/trunk/content_elements/bt_bb_section/bt_bb_section.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbadef9e-1e2d-4bd2-800a-f9369b795728?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-6806","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T08:16:34.090","lastModified":"2026-09-30T16:18:39.783","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"stylemix","product":"Motors – Car Dealership & Classified Listings Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.4.109","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:54:09.787251Z","id":"CVE-2026-6806","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3552483/motors-car-dealership-classified-listings/tags/1.4.110","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b5842d-7b8b-4ea7-b2c3-6ac6fac6d2a6?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-88037","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T08:16:34.277","lastModified":"2026-09-30T16:19:22.193","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"boldthemes","product":"Bold Page Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.7.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:54:45.936542Z","id":"CVE-2026-88037","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3526548/bold-page-builder/trunk/content_elements/bt_bb_service/bt_bb_service.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/402f63fb-c0c6-49b9-b5a9-382435313406?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-92867","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:34.557","lastModified":"2026-09-30T17:16:51.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Pgpool Global Development Group","product":"Pgpool-II","defaultStatus":"unaffected","versions":[{"version":"4.7.0","lessThanOrEqual":"4.7.2","versionType":"semver","status":"affected"},{"version":"4.6.0","lessThanOrEqual":"4.6.7","versionType":"semver","status":"affected"},{"version":"4.5.0","lessThanOrEqual":"4.5.12","versionType":"semver","status":"affected"},{"version":"4.4.0","lessThanOrEqual":"4.4.17","versionType":"semver","status":"affected"},{"version":"4.3.0","lessThanOrEqual":"4.3.20","versionType":"semver","status":"affected"},{"version":"3.5.x","lessThanOrEqual":"4.2.x","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:57:37.566411Z","id":"CVE-2026-92867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://jvn.jp/en/jp/JVN22475874/","source":"vultures@jpcert.or.jp"},{"url":"https://pgpool.net/news/2026-09-29/","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-92868","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:34.723","lastModified":"2026-09-30T20:17:36.983","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Pgpool Global Development Group","product":"Pgpool-II","defaultStatus":"unaffected","versions":[{"version":"4.7.0","lessThanOrEqual":"4.7.2","versionType":"semver","status":"affected"},{"version":"4.6.0","lessThanOrEqual":"4.6.7","versionType":"semver","status":"affected"},{"version":"4.5.0","lessThanOrEqual":"4.5.12","versionType":"semver","status":"affected"},{"version":"4.4.0","lessThanOrEqual":"4.4.17","versionType":"semver","status":"affected"},{"version":"4.3.0","lessThanOrEqual":"4.3.20","versionType":"semver","status":"affected"},{"version":"4.0.x","lessThanOrEqual":"4.2.x","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:40:06.099584Z","id":"CVE-2026-92868","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://jvn.jp/en/jp/JVN22475874/","source":"vultures@jpcert.or.jp"},{"url":"https://pgpool.net/news/2026-09-29/","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-92869","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:34.877","lastModified":"2026-09-30T20:17:37.117","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Pgpool Global Development Group","product":"Pgpool-II","defaultStatus":"unaffected","versions":[{"version":"4.7.0","lessThanOrEqual":"4.7.2","versionType":"semver","status":"affected"},{"version":"4.6.0","lessThanOrEqual":"4.6.7","versionType":"semver","status":"affected"},{"version":"4.5.0","lessThanOrEqual":"4.5.12","versionType":"semver","status":"affected"},{"version":"4.4.0","lessThanOrEqual":"4.4.17","versionType":"semver","status":"affected"},{"version":"4.3.0","lessThanOrEqual":"4.3.20","versionType":"semver","status":"affected"},{"version":"3.5.x","lessThanOrEqual":"4.2.x","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:40:57.866496Z","id":"CVE-2026-92869","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://jvn.jp/en/jp/JVN22475874/","source":"vultures@jpcert.or.jp"},{"url":"https://pgpool.net/news/2026-09-29/","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-92870","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:35.040","lastModified":"2026-09-30T20:17:37.253","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Pgpool Global Development Group","product":"Pgpool-II","defaultStatus":"unaffected","versions":[{"version":"4.7.0","lessThanOrEqual":"4.7.2","versionType":"semver","status":"affected"},{"version":"4.6.0","lessThanOrEqual":"4.6.7","versionType":"semver","status":"affected"},{"version":"4.5.0","lessThanOrEqual":"4.5.12","versionType":"semver","status":"affected"},{"version":"4.4.0","lessThanOrEqual":"4.4.17","versionType":"semver","status":"affected"},{"version":"4.3.0","lessThanOrEqual":"4.3.20","versionType":"semver","status":"affected"},{"version":"3.5.x","lessThanOrEqual":"4.2.x","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:41:45.298402Z","id":"CVE-2026-92870","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://jvn.jp/en/jp/JVN22475874/","source":"vultures@jpcert.or.jp"},{"url":"https://pgpool.net/news/2026-09-29/","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-92871","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:35.193","lastModified":"2026-09-30T16:47:57.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Pgpool Global Development Group","product":"Pgpool-II","defaultStatus":"unaffected","versions":[{"version":"4.7.0","lessThanOrEqual":"4.7.2","versionType":"semver","status":"affected"},{"version":"4.6.0","lessThanOrEqual":"4.6.7","versionType":"semver","status":"affected"},{"version":"4.5.0","lessThanOrEqual":"4.5.12","versionType":"semver","status":"affected"},{"version":"4.4.0","lessThanOrEqual":"4.4.17","versionType":"semver","status":"affected"},{"version":"4.3.0","lessThanOrEqual":"4.3.20","versionType":"semver","status":"affected"},{"version":"3.5.x","lessThanOrEqual":"4.2.x","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:56:12.370889Z","id":"CVE-2026-92871","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://jvn.jp/en/jp/JVN22475874/","source":"vultures@jpcert.or.jp"},{"url":"https://pgpool.net/news/2026-09-29/","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-92872","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:35.347","lastModified":"2026-09-30T17:16:51.250","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Pgpool Global Development Group","product":"Pgpool-II","defaultStatus":"unaffected","versions":[{"version":"4.7.0","lessThanOrEqual":"4.7.2","versionType":"semver","status":"affected"},{"version":"4.6.0","lessThanOrEqual":"4.6.7","versionType":"semver","status":"affected"},{"version":"4.5.0","lessThanOrEqual":"4.5.12","versionType":"semver","status":"affected"},{"version":"4.4.0","lessThanOrEqual":"4.4.17","versionType":"semver","status":"affected"},{"version":"4.3.0","lessThanOrEqual":"4.3.20","versionType":"semver","status":"affected"},{"version":"3.5.x","lessThanOrEqual":"4.2.x","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:58:35.298966Z","id":"CVE-2026-92872","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://jvn.jp/en/jp/JVN22475874/","source":"vultures@jpcert.or.jp"},{"url":"https://pgpool.net/news/2026-09-29/","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-92873","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:35.493","lastModified":"2026-09-30T17:16:51.370","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"Pgpool Global Development Group","product":"Pgpool-II","defaultStatus":"unaffected","versions":[{"version":"4.7.0","lessThanOrEqual":"4.7.2","versionType":"semver","status":"affected"},{"version":"4.6.0","lessThanOrEqual":"4.6.7","versionType":"semver","status":"affected"},{"version":"4.5.0","lessThanOrEqual":"4.5.12","versionType":"semver","status":"affected"},{"version":"4.4.0","lessThanOrEqual":"4.4.17","versionType":"semver","status":"affected"},{"version":"4.3.0","lessThanOrEqual":"4.3.20","versionType":"semver","status":"affected"},{"version":"3.5.x","lessThanOrEqual":"4.2.x","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:58:11.622461Z","id":"CVE-2026-92873","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-303"}]}],"references":[{"url":"https://jvn.jp/en/jp/JVN22475874/","source":"vultures@jpcert.or.jp"},{"url":"https://pgpool.net/news/2026-09-29/","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-93460","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:35.640","lastModified":"2026-10-01T05:17:12.123","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"baserCMS User Community","product":"baserCMS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.4.1","versionType":"semver","status":"affected"},{"version":"0","lessThan":"5.3.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:01:50.030296Z","id":"CVE-2026-93460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://basercms.net/security/JVN_14353754","source":"vultures@jpcert.or.jp"},{"url":"https://jvn.jp/en/jp/JVN14353754","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-93462","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:35.793","lastModified":"2026-10-01T05:17:12.263","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"baserCMS User Community","product":"baserCMS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.4.1","versionType":"semver","status":"affected"},{"version":"0","lessThan":"5.3.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:59:53.038465Z","id":"CVE-2026-93462","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://basercms.net/security/JVN_14353754","source":"vultures@jpcert.or.jp"},{"url":"https://jvn.jp/en/jp/JVN14353754","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-93463","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:35.940","lastModified":"2026-10-02T01:16:44.923","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"baserCMS User Community","product":"baserCMS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.4.1","versionType":"semver","status":"affected"},{"version":"0","lessThan":"5.3.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:02:34.366438Z","id":"CVE-2026-93463","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://basercms.net/security/JVN_14353754","source":"vultures@jpcert.or.jp"},{"url":"https://jvn.jp/en/jp/JVN14353754","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-93464","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:36.083","lastModified":"2026-10-01T05:17:12.520","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"baserCMS User Community","product":"baserCMS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.4.1","versionType":"semver","status":"affected"},{"version":"0","lessThan":"5.3.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:00:25.556207Z","id":"CVE-2026-93464","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://basercms.net/security/JVN_14353754","source":"vultures@jpcert.or.jp"},{"url":"https://jvn.jp/en/jp/JVN14353754","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-97150","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-09-30T08:16:36.230","lastModified":"2026-09-30T16:47:57.730","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"When converting baserCMS4-style addons to baserCMS5-style ones,\r\nBcAddonMigrator includes \"config.php\" from the addon, which means the PHP code in the file is executed.\r\nArbitrary files on the system may be read or deleted by an administrative user."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"baserCMS Users Community","product":"BcAddonMigrator","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:38:52.204555Z","id":"CVE-2026-97150","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://basercms.net/security/JVN_21754394","source":"vultures@jpcert.or.jp"},{"url":"https://github.com/baserproject/BcAddonMigrator/commit/e836bc875e26910e1b5862f96cf280b4f064c104","source":"vultures@jpcert.or.jp"},{"url":"https://jvn.jp/en/jp/JVN21754394","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2025-14564","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T09:17:11.883","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file."},{"lang":"es","value":"El plugin Viable URL Media Uploader para WordPress es vulnerable a Cross-Site Scripting Almacenado a través de cargas de archivos SVG en todas las versiones hasta la 1.0.0, inclusive, debido a una sanitización de entrada y un escape de salida insuficientes. Esto permite que atacantes autenticados, con acceso de nivel de Autor y superior, inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda al archivo SVG."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"ahsangadit","product":"Viable URL Media Uploader","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:52:42.403432Z","id":"CVE-2025-14564","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/viable-url-media-uploader/trunk/includes/class-vumu-svg-support.php#L42","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c600d267-0fed-4682-bc71-5bd0d2f70cae?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-102454","sourceIdentifier":"twcert@cert.org.tw","published":"2026-09-30T09:17:13.170","lastModified":"2026-09-30T16:30:42.327","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server."}],"affected":[{"source":"twcert@cert.org.tw","affectedData":[{"vendor":"DigiWin","product":"EasyFlow .NET","defaultStatus":"unaffected","versions":[{"version":"6.1.*","versionType":"custom","status":"affected"},{"version":"6.6","lessThanOrEqual":"6.6.19","versionType":"custom","status":"affected"},{"version":"8.1","lessThanOrEqual":"8.1.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:55:24.285408Z","id":"CVE-2026-102454","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"twcert@cert.org.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11241-b7eef-2.html","source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-11240-0fa1b-1.html","source":"twcert@cert.org.tw"}]}},{"cve":{"id":"CVE-2026-102455","sourceIdentifier":"twcert@cert.org.tw","published":"2026-09-30T09:17:13.343","lastModified":"2026-09-30T16:30:42.327","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content."}],"affected":[{"source":"twcert@cert.org.tw","affectedData":[{"vendor":"DigiWin","product":"EasyFlow .NET","defaultStatus":"unaffected","versions":[{"version":"6.1.*","status":"affected"},{"version":"6.6","lessThanOrEqual":"6.6.19","versionType":"custom","status":"affected"},{"version":"8.1","lessThanOrEqual":"8.1.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:54:53.660482Z","id":"CVE-2026-102455","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"twcert@cert.org.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html","source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-11237-c9189-1.html","source":"twcert@cert.org.tw"}]}},{"cve":{"id":"CVE-2026-102456","sourceIdentifier":"twcert@cert.org.tw","published":"2026-09-30T09:17:13.503","lastModified":"2026-09-30T16:30:42.327","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents."}],"affected":[{"source":"twcert@cert.org.tw","affectedData":[{"vendor":"DigiWin","product":"EasyFlow .NET","defaultStatus":"unaffected","versions":[{"version":"6.1.*","status":"affected"},{"version":"6.6","lessThanOrEqual":"6.6.19","versionType":"custom","status":"affected"},{"version":"8.1","lessThanOrEqual":"8.1.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:54:43.402181Z","id":"CVE-2026-102456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"twcert@cert.org.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html","source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-11237-c9189-1.html","source":"twcert@cert.org.tw"}]}},{"cve":{"id":"CVE-2026-102457","sourceIdentifier":"twcert@cert.org.tw","published":"2026-09-30T09:17:13.650","lastModified":"2026-09-30T16:30:42.327","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files."}],"affected":[{"source":"twcert@cert.org.tw","affectedData":[{"vendor":"DigiWin","product":"EasyFlow .NET","defaultStatus":"unaffected","versions":[{"version":"6.1.*","status":"affected"},{"version":"6.6","lessThanOrEqual":"6.6.19","versionType":"custom","status":"affected"},{"version":"8.1","lessThanOrEqual":"8.1.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:54:34.389619Z","id":"CVE-2026-102457","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"twcert@cert.org.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html","source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-11237-c9189-1.html","source":"twcert@cert.org.tw"}]}},{"cve":{"id":"CVE-2026-102458","sourceIdentifier":"twcert@cert.org.tw","published":"2026-09-30T09:17:13.800","lastModified":"2026-09-30T16:30:42.327","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API."}],"affected":[{"source":"twcert@cert.org.tw","affectedData":[{"vendor":"DigiWin","product":"EasyFlow .NET","defaultStatus":"unaffected","versions":[{"version":"6.1.*","status":"affected"},{"version":"6.6","lessThanOrEqual":"6.6.19","versionType":"custom","status":"affected"},{"version":"8.1","lessThanOrEqual":"8.1.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:54:24.417057Z","id":"CVE-2026-102458","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"twcert@cert.org.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html","source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-11237-c9189-1.html","source":"twcert@cert.org.tw"}]}},{"cve":{"id":"CVE-2026-102459","sourceIdentifier":"twcert@cert.org.tw","published":"2026-09-30T09:17:13.953","lastModified":"2026-09-30T16:30:42.327","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks."}],"affected":[{"source":"twcert@cert.org.tw","affectedData":[{"vendor":"DigiWin","product":"EasyFlow .NET","defaultStatus":"unaffected","versions":[{"version":"6.1.x","status":"affected"},{"version":"6.6","lessThanOrEqual":"6.6.19","versionType":"custom","status":"affected"},{"version":"8.1","lessThanOrEqual":"8.1.5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:48:45.482718Z","id":"CVE-2026-102459","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"twcert@cert.org.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html","source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-11237-c9189-1.html","source":"twcert@cert.org.tw"}]}},{"cve":{"id":"CVE-2026-102509","sourceIdentifier":"security@apache.org","published":"2026-09-30T09:17:14.100","lastModified":"2026-09-30T16:14:10.347","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC4J) allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service.\n\nIn the OPC UA driver these defects are reachable before authentication: the offending data is parsed while the secure channel and session are being established, before the server's identity has been bound to it. Configuring a trusted server therefore does not prevent exploitation by an attacker who can \nimpersonate it.\n\nThe individual defects are:\n- Length-prefixed byte strings are allocated at the size claimed on the wire before the length is checked against the data actually received (0.10.0 through 0.13.1).\n- Array fields in generated protocol parsers pre-allocate a list with the element count claimed on the wire, allowing a single count field to trigger a multi-gigabyte allocation. This parser is shared by all PLC4J drivers; the OPC UA driver is the verified pre-authentication path (0.10.0 through 0.13.1).\n- The OPC UA driver accumulates message chunks without enforcing the negotiated maximum chunk count and message size (0.12.0 through 0.13.1).\n- The OPC UA driver pre-allocates collections using element counts received from the server (0.10.0 through 0.13.1).\n- Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Go implementation is covered by  CVE-2026-102510 https://cveprocess.apache.org/cve5/CVE-2026-102510 .\n\nThis issue affects Apache PLC4X: from 0.10.0 before 1.0.0.\n\nUsers are recommended to upgrade to version 1.0.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache PLC4X","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.plc4x:plc4j-spi","packageURL":"pkg:maven/org.apache.plc4x/plc4j-spi","versions":[{"version":"0.10.0","lessThan":"1.0.0","versionType":"semver","status":"affected"},{"version":"1.0.0","versionType":"semver","status":"unaffected"}]},{"vendor":"Apache Software Foundation","product":"Apache PLC4X","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.plc4x:plc4j-driver-opcua","packageURL":"pkg:maven/org.apache.plc4x/plc4j-driver-opcua","versions":[{"version":"0.10.0","lessThan":"1.0.0","versionType":"semver","status":"affected"},{"version":"1.0.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:39:55.913450Z","id":"CVE-2026-102509","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-770"},{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://lists.apache.org/thread.html/qngc85qhnlj7kpk3z58z0xlxhz2tn6gp","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-102510","sourceIdentifier":"security@apache.org","published":"2026-09-30T09:17:14.293","lastModified":"2026-09-30T16:14:10.347","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client application,\ncausing a denial of service.\n\nThe individual defects are:\n- Generated parsers pre-allocate arrays with the element count claimed on the wire (0.13.0 through 0.13.1).\n- Transport read helpers allocate buffers of the size claimed on the wire without an upper bound.\n- ADS and KNXnet/IP response handling indexes into received data without checking its length, causing a panic.\n- ADS and EIP frame-length handling accepts, or arithmetically wraps to, a length of zero, breaking message framing.\n- Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Java implementation is covered by  CVE-2026-102509 https://cveprocess.apache.org/cve5/CVE-2026-102509 .\n\nAdditionally, length and position arithmetic in generated serializers was performed in 16-bit integers. If an application forwards attacker-influenced payloads larger than 8 KB, the length field wraps, and the remainder of the payload may be interpreted by the receiving device (for example, an ADS PLC) as \nadditional, independent protocol messages.\n\nThis issue affects Apache PLC4X: from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases.\n\nUsers are recommended to upgrade to version 1.0.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache PLC4X","defaultStatus":"unaffected","collectionURL":"https://golang.org/pkg","packageName":"github.com/apache/plc4x/plc4go","packageURL":"pkg:golang/github.com/apache/plc4x/plc4go","versions":[{"version":"0.11.0","lessThan":"1.0.0","versionType":"semver","status":"affected"},{"version":"1.0.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:40:24.270117Z","id":"CVE-2026-102510","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-129"},{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://lists.apache.org/thread.html/lw66k49p1jf7w0p7h6yg6jqvysborxrs","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-102511","sourceIdentifier":"security@apache.org","published":"2026-09-30T09:17:14.467","lastModified":"2026-09-30T17:16:40.860","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result's connection \naddress was derived from the AmsNetId claimed in the response body rather than from the datagram's actual source address. One spoofed discovery response can therefore insert an inventory entry pointing at any host, including hosts outside the local network, and an application that connects to discovered devices\nwill open its ADS session, including any configured route credentials, to that host.\n\nAdditionally, discovery listeners in both implementations can be disabled by a single malformed datagram:\n- In PLC4Go ADS discovery, a short version block causes a panic that ends the listener for the rest of the discovery call, so legitimate devices answering afterwards are not reported.\n- In PLC4J, the ADS and EtherNet/IP discoverers stop on an unhandled exception from a malformed response.\n- The PLC4J Modbus discoverer can be made to spin indefinitely, consuming a CPU core, by a scanned host that sends a partial response.\n\nExploitation requires the application to invoke the discovery API, which is opt-in, and for the connection redirect, to act on the discovered items.\n\nThis issue affects Apache PLC4X: PLC4Go from 0.11.0 before 1.0.0; PLC4J ADS and Modbus drivers from 0.10.0 before 1.0.0; PLC4J EtherNet/IP driver from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases.\n\nUsers are recommended to upgrade to version 1.0.0, which fixes the issue. Version 1.0.0 derives the connection address from the datagram's source address and logs a warning when the claimed AmsNetId disagrees with it."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache PLC4X","defaultStatus":"unaffected","collectionURL":"https://golang.org/pkg","packageName":"github.com/apache/plc4x/plc4go","packageURL":"pkg:golang/github.com/apache/plc4x/plc4go","versions":[{"version":"0.11.0","lessThan":"1.0.0","versionType":"semver","status":"affected"},{"version":"1.0.0","versionType":"semver","status":"unaffected"}]},{"vendor":"Apache Software Foundation","product":"Apache PLC4X","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.plc4x:plc4j-driver-ads","packageURL":"pkg:maven/org.apache.plc4x/plc4j-driver-ads","versions":[{"version":"0.10.0","lessThan":"1.0.0","versionType":"semver","status":"affected"},{"version":"1.0.0","versionType":"semver","status":"unaffected"}]},{"vendor":"Apache Software Foundation","product":"Apache PLC4X","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.plc4x:plc4j-driver-modbus","packageURL":"pkg:maven/org.apache.plc4x/plc4j-driver-modbus","versions":[{"version":"0.10.0","lessThan":"1.0.0","versionType":"semver","status":"affected"},{"version":"1.0.0","versionType":"semver","status":"unaffected"}]},{"vendor":"Apache Software Foundation","product":"Apache PLC4X","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.plc4x:plc4j-driver-eip","packageURL":"pkg:maven/org.apache.plc4x/plc4j-driver-eip","versions":[{"version":"0.11.0","lessThan":"1.0.0","versionType":"semver","status":"affected"},{"version":"1.0.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:43:37.289772Z","id":"CVE-2026-102511","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-129"},{"lang":"en","value":"CWE-248"},{"lang":"en","value":"CWE-835"},{"lang":"en","value":"CWE-940"}]}],"references":[{"url":"https://lists.apache.org/thread.html/g692j4fklrbo80stjr5ll8xghrwszthf","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/7","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-102577","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:14.660","lastModified":"2026-10-01T14:14:18.313","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF)."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.9","versionType":"semver","status":"affected"},{"version":"0","lessThan":"4.5.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:37:13.429164Z","id":"CVE-2026-102577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.13","matchCriteriaId":"99FF93A9-D754-4DE4-8D1B-B4C324CDA91A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.9","matchCriteriaId":"11BA4A97-DFEA-4813-B107-4BA4C0BD78DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88779","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102577","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543604","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482495","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102578","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:14.810","lastModified":"2026-10-01T14:38:42.597","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.9","versionType":"semver","status":"affected"},{"version":"0","lessThan":"4.5.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:36:52.250310Z","id":"CVE-2026-102578","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.13","matchCriteriaId":"99FF93A9-D754-4DE4-8D1B-B4C324CDA91A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.9","matchCriteriaId":"11BA4A97-DFEA-4813-B107-4BA4C0BD78DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-89383","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102578","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543632","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482496","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102579","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:14.947","lastModified":"2026-10-01T14:21:12.147","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.9","versionType":"semver","status":"affected"},{"version":"0","lessThan":"4.5.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:36:10.291452Z","id":"CVE-2026-102579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-359"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.13","matchCriteriaId":"99FF93A9-D754-4DE4-8D1B-B4C324CDA91A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.9","matchCriteriaId":"11BA4A97-DFEA-4813-B107-4BA4C0BD78DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-89381","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102579","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543633","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482497","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102580","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:15.080","lastModified":"2026-10-01T14:36:39.630","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.9","versionType":"semver","status":"affected"},{"version":"0","lessThan":"4.5.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.2,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:35:40.489112Z","id":"CVE-2026-102580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-470"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.13","matchCriteriaId":"99FF93A9-D754-4DE4-8D1B-B4C324CDA91A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.9","matchCriteriaId":"11BA4A97-DFEA-4813-B107-4BA4C0BD78DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-89078","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102580","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543635","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482498","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102581","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:15.213","lastModified":"2026-10-01T15:19:52.710","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.9","versionType":"semver","status":"affected"},{"version":"0","lessThan":"4.5.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:34:52.043531Z","id":"CVE-2026-102581","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.13","matchCriteriaId":"99FF93A9-D754-4DE4-8D1B-B4C324CDA91A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.9","matchCriteriaId":"11BA4A97-DFEA-4813-B107-4BA4C0BD78DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88981","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102581","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543634","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482499","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102582","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:15.350","lastModified":"2026-10-01T15:18:00.730","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments even after an administrator disabled the feature in the user interface."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.9","versionType":"semver","status":"affected"},{"version":"0","lessThan":"4.5.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.2,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:33:57.553017Z","id":"CVE-2026-102582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-425"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.13","matchCriteriaId":"99FF93A9-D754-4DE4-8D1B-B4C324CDA91A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.9","matchCriteriaId":"11BA4A97-DFEA-4813-B107-4BA4C0BD78DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88593","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102582","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543636","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482500","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102583","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:15.493","lastModified":"2026-10-01T15:15:21.197","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI image generation functionality."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.9","versionType":"semver","status":"affected"},{"version":"0","lessThan":"4.5.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:33:20.498442Z","id":"CVE-2026-102583","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-425"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.13","matchCriteriaId":"99FF93A9-D754-4DE4-8D1B-B4C324CDA91A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.9","matchCriteriaId":"11BA4A97-DFEA-4813-B107-4BA4C0BD78DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88587","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102583","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543640","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482501","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102584","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:15.630","lastModified":"2026-10-01T14:48:32.280","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:57:03.802504Z","id":"CVE-2026-102584","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-425"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.9","matchCriteriaId":"11BA4A97-DFEA-4813-B107-4BA4C0BD78DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88585","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102584","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543637","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482502","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102585","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:15.763","lastModified":"2026-10-01T14:47:35.113","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:56:55.836555Z","id":"CVE-2026-102585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-842"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88538","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102585","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543639","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482503","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102586","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:15.897","lastModified":"2026-10-01T15:48:31.997","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.9","versionType":"semver","status":"affected"},{"version":"0","lessThan":"4.5.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:56:33.265497Z","id":"CVE-2026-102586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.13","matchCriteriaId":"99FF93A9-D754-4DE4-8D1B-B4C324CDA91A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.9","matchCriteriaId":"11BA4A97-DFEA-4813-B107-4BA4C0BD78DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88335","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102586","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543641","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482504","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102587","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:16.023","lastModified":"2026-10-01T14:29:38.930","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.9","versionType":"semver","status":"affected"},{"version":"0","lessThan":"4.5.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:56:25.921374Z","id":"CVE-2026-102587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-204"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.13","matchCriteriaId":"99FF93A9-D754-4DE4-8D1B-B4C324CDA91A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.9","matchCriteriaId":"11BA4A97-DFEA-4813-B107-4BA4C0BD78DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87518","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102587","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543642","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482506","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102588","sourceIdentifier":"patrick@puiterwijk.org","published":"2026-09-30T09:17:16.163","lastModified":"2026-10-01T15:51:47.490","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization."}],"affected":[{"source":"patrick@puiterwijk.org","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://git.moodle.org","packageName":"moodle","versions":[{"version":"5.2.0","lessThan":"5.2.2","versionType":"semver","status":"affected"},{"version":"5.1.0","lessThan":"5.1.6","versionType":"semver","status":"affected"},{"version":"5.0.0","lessThan":"5.0.9","versionType":"semver","status":"affected"},{"version":"0","lessThan":"4.5.13","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:56:19.288426Z","id":"CVE-2026-102588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"patrick@puiterwijk.org","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.13","matchCriteriaId":"99FF93A9-D754-4DE4-8D1B-B4C324CDA91A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.0.9","matchCriteriaId":"11BA4A97-DFEA-4813-B107-4BA4C0BD78DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1.0","versionEndExcluding":"5.1.6","matchCriteriaId":"37F95B02-166C-45BA-B537-21CB5084001F"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2.0","versionEndExcluding":"5.2.2","matchCriteriaId":"EFDDCBAE-2DFF-45D6-A90A-2A9AC1743722"}]}]}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84545","source":"patrick@puiterwijk.org","tags":["Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102588","source":"patrick@puiterwijk.org","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543643","source":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=482507","source":"patrick@puiterwijk.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-75098","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T09:17:16.320","lastModified":"2026-09-30T16:18:58.363","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"productdesignerapp","product":"Product Designer App","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:53:17.270023Z","id":"CVE-2026-75098","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-front-ajax.php#L625","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-helpers.php#L261","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/includes/productdesignerapp-helpers.php#L2867","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/product-designer-app/trunk/templates/default/script/variants.php#L22","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e94db231-e5d4-4b49-ad36-74c0284abfd2?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-92712","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T09:17:16.477","lastModified":"2026-09-30T16:19:25.270","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the permalink parameter is only passed through sanitize_url(), which does not prevent fetching attacker-controlled remote URLs whose response body — including script tags and event-handler attributes — is written verbatim to disk via file_put_contents()."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"rockiger","product":"ReactPress – Create React App for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:53:07.068122Z","id":"CVE-2026-92712","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/reactpress/tags/3.4.0/admin/Admin.php#L220","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/reactpress/tags/3.4.0/admin/Controller.php#L201","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/reactpress/tags/3.4.0/admin/Controller.php#L339","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/reactpress/tags/3.4.0/includes/Core.php#L153","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaea5a3b-6565-4aa0-864d-5a2b764075fd?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93908","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T09:17:16.630","lastModified":"2026-10-21T01:17:39.580","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is further enabled by the absence of any capability, nonce, or ownership check on the wp_ajax_rem_create_pro_ajax handler, and because the value is persisted via update_post_meta rather than post_content, the wp_kses filtering tied to the unfiltered_html capability does not apply."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"rameez_iqbal","product":"Real Estate Manager – Property Listing and Agent Management","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:53:27.210593Z","id":"CVE-2026-93908","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/webcodingplace/real-estate-manager","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/7.3/classes/shortcodes.class.php#L1705","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/7.3/classes/shortcodes.class.php#L1776","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/real-estate-manager/tags/7.3/core.functions.php#L178","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b05171e-e27f-437b-b9a8-0636da7bee8d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-97347","sourceIdentifier":"security@wordfence.com","published":"2026-09-30T09:17:16.773","lastModified":"2026-09-30T16:19:26.470","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's only input filter is a substring blacklist for known bot signatures (e.g. 'bot', 'spider', 'crawler'), which can be trivially bypassed by crafting a User-Agent payload that omits those strings."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"kazukiyanamoto","product":"Post Views Stats Counter","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.1.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:53:35.354777Z","id":"CVE-2026-97347","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/post-views-stats-counter/tags/1.1.7/manage/admin.php#L447","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-views-stats-counter/tags/1.1.7/manage/admin.php#L681","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-views-stats-counter/tags/1.1.7/wp_pvscounter.php#L269","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/post-views-stats-counter/tags/1.1.7/wp_pvscounter.php#L411","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/086a8577-eb23-4e05-8ff6-7bbfef62d25c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-103235","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-30T10:17:16.243","lastModified":"2026-09-30T15:22:26.357","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id.\n\nAn authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance. Because a delegation row grants the requesting organisation read access to the event it references, this effectively granted read access to arbitrary events belonging to other organisations. If the target organisation subsequently accepted the delegation, ownership of the event was transferred and the original record was deleted.\n\nPreconditions:\n\n- An authenticated user with the delegation permission (perm_delegate)\n\n- The MISP.delegation server setting must be enabled\n\nImpact:\n\n- Confidentiality: read access to any event on the instance\n\n- Integrity: overwriting existing delegation records and transferring event ownership\n\nAffected versions: MISP < 2.5.48"}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"MISP","product":"MISP","defaultStatus":"unaffected","cpes":["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"],"modules":["EventDelegationsController"],"programFiles":["app/Controller/EventDelegationsController.php"],"repo":"https://github.com/MISP/MISP","versions":[{"version":"0","lessThan":"2.5.48","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:32:35.584208Z","id":"CVE-2026-103235","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-915"}]}],"references":[{"url":"https://github.com/MISP/MISP/commit/d1f5684f9","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-103237","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-30T10:17:16.687","lastModified":"2026-09-30T18:18:15.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit), the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller's context. However, the underlying ORM's set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields.\n\nAn authenticated user with basic write permissions can exploit this by embedding a nested block under the model alias key inside their request. The sanitization logic (id removal, event_id pinning) is applied to the outer record, but the ORM binds to the inner record instead, which carries an attacker-chosen id and event_id. This allows the attacker to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to.\n\nImpact:\n\n- Cross-tenant data integrity compromise (attribute values rewritten, objects re-parented to attacker events, rows soft-deleted)\n\n- Affects multiple entity types: Attribute, Object, EventReport, Sighting, AttributeTag, ShadowAttribute\n\n- Requires only a low-privilege authenticated account with perm_add\n\nAffected versions: <2.5.48"}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"MISP","product":"MISP","cpes":["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"],"modules":["AttributesController","EventReportsController","EventsController","ObjectReferencesController","ShadowAttributesController","UsersController","AppModel","Event model","MispAttribute model","MispObject model","ShadowAttribute model","Sighting model"],"repo":"https://github.com/MISP/MISP","versions":[{"version":"0","lessThan":"2.5.48","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:08:29.034418Z","id":"CVE-2026-103237","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/MISP/MISP/commit/9485ae40d","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-10764","sourceIdentifier":"4237bc98-ed97-4aeb-8e67-37a47a9e179d","published":"2026-09-30T10:17:16.960","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data."}],"affected":[{"source":"4237bc98-ed97-4aeb-8e67-37a47a9e179d","affectedData":[{"vendor":"IQSIGHT","product":"BVMS","defaultStatus":"unaffected","versions":[{"version":"4.5","lessThanOrEqual":"12.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"4237bc98-ed97-4aeb-8e67-37a47a9e179d","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:30:25.059031Z","id":"CVE-2026-10764","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"4237bc98-ed97-4aeb-8e67-37a47a9e179d","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://www.iqsight.com/f/292130204896374/x/594fff1c4a/iqsight-sa-261342.pdf","source":"4237bc98-ed97-4aeb-8e67-37a47a9e179d"}]}},{"cve":{"id":"CVE-2026-77185","sourceIdentifier":"security@apache.org","published":"2026-09-30T10:17:17.123","lastModified":"2026-09-30T17:16:49.877","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server.\n\n\n\n\nApache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform \"asynchronous authentication\" exists. A server implemented with Apache MINA SSHD must contain explicit code to make use of this feature. The implementation of this feature was flawed and could potentially lead to skipping checking the signature in public-key or hostbased authentication, or returning a wrong result.\n\n\n\n\nUsers are recommended to upgrade to Apache MINA SSHD 2.20.0 or 3.0.0-M6, which fix the logic error and which additionally forbid the use of this \"asynchronous authentication\" mechanism with the public-key or hostbased authentication schemes: if used, the SSH session will be closed and the server will log an entry indicating that asynchronous authentication may be used only with password or keyboard-interactive authentication."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.sshd:sshd-core","packageURL":"pkg:maven/org.apache.sshd/sshd-core","versions":[{"version":"2.0.0","lessThan":"2.20.0","versionType":"maven","status":"affected"},{"version":"3.0.0-M1","lessThan":"3.0.0-M6","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:51:36.604858Z","id":"CVE-2026-77185","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-305"}]}],"references":[{"url":"https://lists.apache.org/thread.html/t8pn812yq8ndokxyfxztg8tovov1284n","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/32","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-79625","sourceIdentifier":"info@cert.vde.com","published":"2026-09-30T10:17:17.273","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition."}],"affected":[{"source":"info@cert.vde.com","affectedData":[{"vendor":"CODESYS","product":"Control RTE (SL)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control RTE (for Beckhoff CX) SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control Win (SL)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Runtime Toolkit","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Safety SIL2","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"HMI (SL)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Development System 3","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control for BeagleBone SL","defaultStatus":"unaffected","versions":[{"version":"3.5.0.0","lessThan":"4.23.0.0","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control for emPC-A/iMX6 SL","defaultStatus":"unaffected","versions":[{"version":"3.5.0.0","lessThan":"4.23.0.0","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control for IOT2000 SL","defaultStatus":"unaffected","versions":[{"version":"3.5.0.0","lessThan":"4.23.0.0","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control for Linux ARM SL","defaultStatus":"unaffected","versions":[{"version":"3.5.0.0","lessThan":"4.23.0.0","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control for Linux SL","defaultStatus":"unaffected","versions":[{"version":"3.5.0.0","lessThan":"4.23.0.0","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control for PFC100 SL","defaultStatus":"unaffected","versions":[{"version":"3.5.0.0","lessThan":"4.23.0.0","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control for PFC200 SL","defaultStatus":"unaffected","versions":[{"version":"3.5.0.0","lessThan":"4.23.0.0","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control for PLCnext SL","defaultStatus":"unaffected","versions":[{"version":"3.5.0.0","lessThan":"4.23.0.0","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control for Raspberry Pi SL","defaultStatus":"unaffected","versions":[{"version":"3.5.0.0","lessThan":"4.23.0.0","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Control for WAGO Touch Panels 600 SL","defaultStatus":"unaffected","versions":[{"version":"3.5.0.0","lessThan":"4.23.0.0","versionType":"semver","status":"affected"}]},{"vendor":"CODESYS","product":"Virtual Control SL","defaultStatus":"unaffected","versions":[{"version":"3.5.0.0","lessThan":"4.23.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"info@cert.vde.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"info@cert.vde.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:49:04.420443Z","id":"CVE-2026-79625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"info@cert.vde.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://www.certvde.com/en/advisories/VDE-2026-097/","source":"info@cert.vde.com"}]}},{"cve":{"id":"CVE-2026-93994","sourceIdentifier":"security@apache.org","published":"2026-09-30T10:17:17.460","lastModified":"2026-09-30T16:13:13.493","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods \"publickey,publickey\". Apache MINA SSHD provides an equivalent configuration mechanism.\n\n\n\n\nIn Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.\n\n\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.sshd:sshd-core","packageURL":"pkg:maven/org.apache.sshd/sshd-core","versions":[{"version":"0","lessThan":"2.20.0","versionType":"maven","status":"affected"},{"version":"3.0.0-M1","lessThan":"3.0.0-M6","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:29:28.530614Z","id":"CVE-2026-93994","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-304"}]}],"references":[{"url":"https://lists.apache.org/thread.html/9t3vsm8rnvwdv9779mlg1lq2fbwojdwp","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/33","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-93995","sourceIdentifier":"security@apache.org","published":"2026-09-30T10:17:17.597","lastModified":"2026-09-30T16:13:13.493","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache \nMINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nComponent org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such \nthat authenticated SSH clients can remotely execute git commands via the JGit library \non git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including \"git archive\" without \"--output\" or \"-o\" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection.\n\n\n\n\nThe fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument \"-o=file.zip\" version of the command parameter from the \"archive\" command.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.sshd:sshd-git","packageURL":"pkg:maven/org.apache.sshd/sshd-git","versions":[{"version":"0","lessThan":"2.20.0","versionType":"maven","status":"affected"},{"version":"3.0.0-M1","lessThan":"3.0.0-M6","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:30:48.778493Z","id":"CVE-2026-93995","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://lists.apache.org/thread.html/k13ox2xlry38h9gh6rhmh1d9zs345clk","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-93996","sourceIdentifier":"security@apache.org","published":"2026-09-30T10:17:17.740","lastModified":"2026-09-30T16:13:13.493","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nComponent sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.sshd:sshd-scp","packageURL":"pkg:maven/org.apache.sshd/sshd-scp","versions":[{"version":"0","lessThan":"2.20.0","versionType":"maven","status":"affected"},{"version":"3.0.0-M1","lessThan":"3.0.0-M6","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:31:11.836876Z","id":"CVE-2026-93996","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://lists.apache.org/thread.html/xwk8vogkpphcpm01hrt9tb6mgnpjzp35","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/35","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-94002","sourceIdentifier":"security@apache.org","published":"2026-09-30T10:17:17.877","lastModified":"2026-09-30T16:13:13.493","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.\n\n\n\n\nApache \nMINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP.\n\n\n\n\nThe SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.sshd:sshd-sftp","packageURL":"pkg:maven/org.apache.sshd/sshd-sftp","versions":[{"version":"0.9.0","lessThan":"2.20.0","versionType":"maven","status":"affected"},{"version":"3.0.0-M1","lessThan":"3.0.0-M6","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:31:35.789900Z","id":"CVE-2026-94002","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://lists.apache.org/thread.html/x2cb00kh4qvsq145tj2w4g3toy8cybld","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/36","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-94029","sourceIdentifier":"security@apache.org","published":"2026-09-30T10:17:18.010","lastModified":"2026-09-30T20:17:37.383","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-name/check-file-handle extension. Apache MINA SSHD is a Java library for client-side and server-side SSH.\n\n\n\n\nUsing a very small \"block size\" (for instance 256, which is the minimum) on a huge file generates many (file size / block size) hashes. The resulting SFTP reply message was accumulated fully in memory server-side, which could, with a suitably large (possibly sparse) file exhaust the server-side memory, taking down the server.\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by imposing a maximum limit on the size of the reply. Many SFTP implementations have a general limit on the size of SFTP messages anyway; typically 256kB as in OpenSSH or also in Apache MINA SSHD."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.sshd:sshd-sftp","packageURL":"pkg:maven/org.apache.sshd/sshd-sftp","versions":[{"version":"1.0.0","lessThan":"2.20.0","versionType":"maven","status":"affected"},{"version":"3.0.0-M1","lessThan":"3.0.0-M6","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:42:43.742304Z","id":"CVE-2026-94029","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://lists.apache.org/thread.html/ytbl4rwby62xl7llm3wp7k975wwdx99t","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/37","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-94052","sourceIdentifier":"security@apache.org","published":"2026-09-30T10:17:18.147","lastModified":"2026-09-30T16:13:13.493","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks.\n\n\n\n\nApache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server.\n\n\n\n\nsshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is _not_ affected by this vulnerability, which concerns only LdapPasswordAuthenticator.\n\n\n\n\nUsers are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.sshd:sshd-ldap","packageURL":"pkg:maven/org.apache.sshd/sshd-ldap","versions":[{"version":"1.2.0","lessThan":"2.20.0","versionType":"maven","status":"affected"},{"version":"3.0.0-M1","lessThan":"3.0.0-M6","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:32:02.226594Z","id":"CVE-2026-94052","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-304"}]}],"references":[{"url":"https://lists.apache.org/thread.html/qch5kdwwms13y6bylb7c6qqzq718wn24","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/38","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-94053","sourceIdentifier":"security@apache.org","published":"2026-09-30T10:17:18.283","lastModified":"2026-09-30T16:13:13.493","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.\n\n\n\n\nApache MINA SSHD is a Java library for client-side and server-side SSH. \nThe optional sshd-ldap component provides support for integrating \npassword and publickey authentication on the server side with an LDAP \nserver.\n\n\n\n\nsshd-ldap is an optional component. SSH servers implemented with Apache \nMINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication.\n\nOther Apache MINA SSHD servers are not affected.\n\n\n\n\nLack of escaping LDAP filter metacharacters enabled successful authentication with username \"*\" and password \"*\".\n\n\n\n\nUsers are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping filter parameters according to RFC 4515."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.sshd:sshd-ldap","packageURL":"pkg:maven/org.apache.sshd/sshd-ldap","versions":[{"version":"1.2.0","lessThan":"2.20.0","versionType":"maven","status":"affected"},{"version":"3.0.0-M1","lessThan":"3.0.0-M6","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:29:56.091889Z","id":"CVE-2026-94053","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-90"},{"lang":"en","value":"CWE-305"}]}],"references":[{"url":"https://lists.apache.org/thread.html/cyrxkdzl3c70rrqs3klqphqz1hwm7p41","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/39","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-103113","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T11:16:43.330","lastModified":"2026-10-01T16:17:35.557","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"OS4ED","product":"openSIS-Classic","cpes":["cpe:2.3:a:os4ed:opensis-classic:*:*:*:*:*:*:*:*"],"modules":["General Information Tab"],"versions":[{"version":"9.0","status":"affected"},{"version":"9.1","status":"affected"},{"version":"9.2","status":"affected"},{"version":"9.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:42:37.884326Z","id":"CVE-2026-103113","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/OS4ED/openSIS-Classic/","source":"cna@vuldb.com"},{"url":"https://github.com/OS4ED/openSIS-Classic/issues/473","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103113","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/954959","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411869","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411869/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103239","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-30T11:16:43.527","lastModified":"2026-09-30T17:16:42.360","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload.\n\nA user holding the tag editor permission could craft a request that includes additional model data (such as User or Organisation records) alongside the tag collection fields. Because the save operation processed all associated models indiscriminately, the injected sibling records were written to the database, enabling the attacker to modify or create privileged accounts and escalate to site administrator.\n\nPreconditions:\n\n- An authenticated account with the tag editor permission (perm_tag_editor)\n\n- Network access to the MISP instance\n\nImpact:\n\n- Unauthorized creation or modification of User and Organisation records\n\n- Privilege escalation from tag editor to site administrator\n\nAffected versions: < 2.5.48"}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"MISP","product":"MISP","cpes":["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"],"modules":["TagCollectionsController"],"programFiles":["app/Controller/TagCollectionsController.php"],"repo":"https://github.com/MISP/MISP","versions":[{"version":"0","lessThan":"2.5.48","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:49:52.252773Z","id":"CVE-2026-103239","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/MISP/MISP/commit/96f735e7b","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-13719","sourceIdentifier":"security@grafana.com","published":"2026-09-30T11:16:43.757","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed."}],"affected":[{"source":"security@grafana.com","affectedData":[{"vendor":"Grafana","product":"Grafana Enterprise","defaultStatus":"unaffected","versions":[{"version":"12.3.0","lessThanOrEqual":"12.3.11","versionType":"semver","status":"affected"},{"version":"12.4.0","lessThan":"12.4.12","versionType":"semver","status":"affected"},{"version":"13.0.0","lessThan":"13.0.10","versionType":"semver","status":"affected"},{"version":"13.1.0","lessThan":"13.1.7","versionType":"semver","status":"affected"},{"version":"13.2.0","lessThan":"13.2.3","versionType":"semver","status":"affected"}]},{"vendor":"Grafana","product":"Grafana OSS","defaultStatus":"unaffected","versions":[{"version":"12.3.0","lessThanOrEqual":"12.3.11","versionType":"semver","status":"affected"},{"version":"12.4.0","lessThan":"12.4.12","versionType":"semver","status":"affected"},{"version":"13.0.0","lessThan":"13.0.10","versionType":"semver","status":"affected"},{"version":"13.1.0","lessThan":"13.1.7","versionType":"semver","status":"affected"},{"version":"13.2.0","lessThan":"13.2.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@grafana.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:29:01.284869Z","id":"CVE-2026-13719","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@grafana.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-13719","source":"security@grafana.com"}]}},{"cve":{"id":"CVE-2026-13720","sourceIdentifier":"security@grafana.com","published":"2026-09-30T11:16:43.893","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed."}],"affected":[{"source":"security@grafana.com","affectedData":[{"vendor":"Grafana","product":"Grafana OSS","defaultStatus":"unaffected","versions":[{"version":"12.0.0","lessThanOrEqual":"12.0.10","versionType":"semver","status":"affected"},{"version":"12.1.0","lessThanOrEqual":"12.1.10","versionType":"semver","status":"affected"},{"version":"12.2.0","lessThanOrEqual":"12.2.11","versionType":"semver","status":"affected"},{"version":"12.3.0","lessThanOrEqual":"12.3.11","versionType":"semver","status":"affected"},{"version":"12.4.0","lessThan":"12.4.12","versionType":"semver","status":"affected"},{"version":"13.0.0","lessThan":"13.0.10","versionType":"semver","status":"affected"},{"version":"13.1.0","lessThan":"13.1.7","versionType":"semver","status":"affected"},{"version":"13.2.0","lessThan":"13.2.3","versionType":"semver","status":"affected"}]},{"vendor":"Grafana","product":"Grafana Enterprise","defaultStatus":"unaffected","versions":[{"version":"12.0.0","lessThanOrEqual":"12.0.10","versionType":"semver","status":"affected"},{"version":"12.1.0","lessThanOrEqual":"12.1.10","versionType":"semver","status":"affected"},{"version":"12.2.0","lessThanOrEqual":"12.2.11","versionType":"semver","status":"affected"},{"version":"12.3.0","lessThanOrEqual":"12.3.11","versionType":"semver","status":"affected"},{"version":"12.4.0","lessThan":"12.4.12","versionType":"semver","status":"affected"},{"version":"13.0.0","lessThan":"13.0.10","versionType":"semver","status":"affected"},{"version":"13.1.0","lessThan":"13.1.7","versionType":"semver","status":"affected"},{"version":"13.2.0","lessThan":"13.2.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@grafana.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:55:59.494551Z","id":"CVE-2026-13720","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@grafana.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-915"}]}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-13720","source":"security@grafana.com"}]}},{"cve":{"id":"CVE-2026-76992","sourceIdentifier":"info@cert.vde.com","published":"2026-09-30T11:16:47.283","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a denial-of-service condition thus leading to a total loss of availablity."}],"affected":[{"source":"info@cert.vde.com","affectedData":[{"vendor":"CODESYS","product":"Development System 3","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic","status":"affected"}]},{"vendor":"CODESYS","product":"Gateway","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic","status":"affected"}]},{"vendor":"CODESYS","product":"Edge Gateway for Windows","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic","status":"affected"}]},{"vendor":"CODESYS","product":"HMI (SL)","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic","status":"affected"}]},{"vendor":"CODESYS","product":"OPC DA Server SL","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic","status":"affected"}]},{"vendor":"CODESYS","product":"PLCHandler","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic","status":"affected"}]},{"vendor":"CODESYS","product":"Runtime Toolkit","defaultStatus":"unaffected","versions":[{"version":"3.0.0.0","lessThan":"3.5.22.40","versionType":"generic","status":"affected"}]},{"vendor":"CODESYS","product":"Edge Gateway for Linux","defaultStatus":"unaffected","versions":[{"version":"3.15.0.0","lessThan":"4.23.0.0","versionType":"generic","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"info@cert.vde.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"info@cert.vde.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:48:15.816736Z","id":"CVE-2026-76992","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"info@cert.vde.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://www.certvde.com/en/advisories/VDE-2026-094/","source":"info@cert.vde.com"}]}},{"cve":{"id":"CVE-2026-96342","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T11:16:48.263","lastModified":"2026-09-30T14:18:07.807","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Amauri.IO","product":"WPMobile.App","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpappninja","versions":[{"version":"0","lessThanOrEqual":"11.83","versionType":"custom","status":"affected","changes":[{"at":"11.84","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:52:11.646552Z","id":"CVE-2026-96342","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpappninja/vulnerability/wordpress-wpmobile-app-plugin-11-83-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103012","sourceIdentifier":"98a01053-8a31-4f6d-9aa9-252be161adc6","published":"2026-09-30T12:17:12.303","lastModified":"2026-09-30T16:12:10.307","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated with the Enterprise or Team account. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy (such as permission deny rules, model restrictions and managed-only locks) or, if a previously cached copy existed on the machine, kept applying that stale copy without receiving later policy changes — while continuing to operate as the organization's account. Triggering this required local access to a device with such a stored API key; the no-policy case additionally required that no managed settings had previously been cached. Endpoint-managed (MDM or file-based) settings were not affected. Claude for Enterprise organizations were affected from version 2.0.68; Claude for Work (Team) organizations from version 2.1.38, when server-managed settings became available to them.\n\nUsers on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.1.260 or later.\n\nThank you to Tamas Voros / NVIDIA AI Red Team for reporting this issue."}],"affected":[{"source":"98a01053-8a31-4f6d-9aa9-252be161adc6","affectedData":[{"vendor":"Anthropic","product":"@anthropic-ai/claude-code","versions":[{"version":"2.0.68","lessThan":"2.1.260","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"98a01053-8a31-4f6d-9aa9-252be161adc6","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:28:28.868892Z","id":"CVE-2026-103012","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"98a01053-8a31-4f6d-9aa9-252be161adc6","type":"Secondary","description":[{"lang":"en","value":"CWE-696"}]}],"references":[{"url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-gfvf-j8jh-jxxw","source":"98a01053-8a31-4f6d-9aa9-252be161adc6"}]}},{"cve":{"id":"CVE-2026-103114","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T12:17:12.457","lastModified":"2026-09-30T14:17:27.010","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"OS4ED","product":"openSIS-Classic","cpes":["cpe:2.3:a:os4ed:opensis-classic:*:*:*:*:*:*:*:*"],"modules":["Assignment Management Endpoint"],"versions":[{"version":"9.0","status":"affected"},{"version":"9.1","status":"affected"},{"version":"9.2","status":"affected"},{"version":"9.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:46:55.936465Z","id":"CVE-2026-103114","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/OS4ED/openSIS-Classic/","source":"cna@vuldb.com"},{"url":"https://github.com/OS4ED/openSIS-Classic/issues/474","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103114","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/954960","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411870","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411870/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103242","sourceIdentifier":"secalert@redhat.com","published":"2026-09-30T12:17:12.653","lastModified":"2026-09-30T17:16:42.773","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/a:redhat:hummingbird:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:36:10.336744Z","id":"CVE-2026-103242","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-103242","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543866","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-10726","sourceIdentifier":"2505284f-8ffb-486c-bf60-e19c1097a90b","published":"2026-09-30T12:17:12.810","lastModified":"2026-09-30T19:38:27.293","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement."}],"affected":[{"source":"2505284f-8ffb-486c-bf60-e19c1097a90b","affectedData":[{"vendor":"Cato Networks","product":"SDP Client","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"6.12.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"2505284f-8ffb-486c-bf60-e19c1097a90b","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:27:19.974513Z","id":"CVE-2026-10726","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"2505284f-8ffb-486c-bf60-e19c1097a90b","type":"Secondary","description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://knowledge.catonetworks.com/docs/cve-2026-10726-cve-2026-10739-impacts-windows-client-versions-lower-than-6126","source":"2505284f-8ffb-486c-bf60-e19c1097a90b"}]}},{"cve":{"id":"CVE-2026-10739","sourceIdentifier":"2505284f-8ffb-486c-bf60-e19c1097a90b","published":"2026-09-30T12:17:12.963","lastModified":"2026-09-30T19:38:27.293","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe."}],"affected":[{"source":"2505284f-8ffb-486c-bf60-e19c1097a90b","affectedData":[{"vendor":"Cato Networks","product":"SDP Client","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"6.12.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"2505284f-8ffb-486c-bf60-e19c1097a90b","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:27:45.762535Z","id":"CVE-2026-10739","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"2505284f-8ffb-486c-bf60-e19c1097a90b","type":"Secondary","description":[{"lang":"en","value":"CWE-23"},{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://knowledge.catonetworks.com/docs/cve-2026-10726-cve-2026-10739-impacts-windows-client-versions-lower-than-6126","source":"2505284f-8ffb-486c-bf60-e19c1097a90b"}]}},{"cve":{"id":"CVE-2026-62146","sourceIdentifier":"secalert@redhat.com","published":"2026-09-30T12:17:13.617","lastModified":"2026-09-30T20:17:34.013","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cri-o","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:57:40.257250Z","id":"CVE-2026-62146","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-501"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-62146","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499618","source":"secalert@redhat.com"},{"url":"https://github.com/cri-o/cri-o/security/advisories/GHSA-6wmc-5877-hgc9","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-85532","sourceIdentifier":"security@apache.org","published":"2026-09-30T12:17:13.933","lastModified":"2026-10-02T20:14:49.163","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes.\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache WSS4J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wss4j:wss4j-ws-security-common","packageURL":"pkg:maven/org.apache.wss4j/wss4j-ws-security-common","versions":[{"version":"4.0.0","lessThan":"4.0.2","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.6","versionType":"semver","status":"affected"},{"version":"0","lessThan":"2.4.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:44:50.188327Z","id":"CVE-2026-85532","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.4","matchCriteriaId":"A3409718-5467-407D-9B51-14E58B6D2F68"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.6","matchCriteriaId":"31AFF243-7BCE-44BC-85C5-6FE257642C13"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.2","matchCriteriaId":"20E76C98-444D-4DB5-91E0-90E84C196158"}]}]}],"references":[{"url":"https://lists.apache.org/thread.html/7jllcpbf4nbzhdp2vchz5yplnl5w6vd6","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-87830","sourceIdentifier":"security@apache.org","published":"2026-09-30T12:17:14.087","lastModified":"2026-10-06T17:26:47.927","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption.\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache WSS4J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wss4j:wss4j-ws-security-policy-stax","packageURL":"pkg:maven/org.apache.wss4j/wss4j-ws-security-policy-stax","versions":[{"version":"4.0.0","lessThan":"4.0.2","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.6","versionType":"semver","status":"affected"},{"version":"0","lessThan":"2.4.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:46:48.561887Z","id":"CVE-2026-87830","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-917"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.4","matchCriteriaId":"A3409718-5467-407D-9B51-14E58B6D2F68"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.6","matchCriteriaId":"31AFF243-7BCE-44BC-85C5-6FE257642C13"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.2","matchCriteriaId":"20E76C98-444D-4DB5-91E0-90E84C196158"}]}]}],"references":[{"url":"https://lists.apache.org/thread.html/lwlozb1x20d16f9dnyvoygc9rrhzq2vn","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/9","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-88920","sourceIdentifier":"security@apache.org","published":"2026-09-30T12:17:14.203","lastModified":"2026-10-02T20:17:49.397","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key.\n\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache WSS4J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wss4j:wss4j-ws-security-dom","packageURL":"pkg:maven/org.apache.wss4j/wss4j-ws-security-dom","versions":[{"version":"4.0.0","lessThan":"4.0.2","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.6","versionType":"semver","status":"affected"},{"version":"0","lessThan":"2.4.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:48:23.012347Z","id":"CVE-2026-88920","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.4","matchCriteriaId":"A3409718-5467-407D-9B51-14E58B6D2F68"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.6","matchCriteriaId":"31AFF243-7BCE-44BC-85C5-6FE257642C13"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.2","matchCriteriaId":"20E76C98-444D-4DB5-91E0-90E84C196158"}]}]}],"references":[{"url":"https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/10","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-100507","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:14.577","lastModified":"2026-10-07T07:16:56.783","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"If-So Dynamic Content","product":"If-So Dynamic Content Personalization","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"if-so","versions":[{"version":"0","lessThanOrEqual":"1.10.1","versionType":"custom","status":"affected","changes":[{"at":"1.10.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:57:39.996380Z","id":"CVE-2026-100507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/if-so/vulnerability/wordpress-if-so-dynamic-content-personalization-plugin-1-10-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-100508","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:15.203","lastModified":"2026-09-30T14:17:22.123","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WordPress.org","product":"Two Factor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"two-factor","versions":[{"version":"n/a","lessThanOrEqual":"0.16.0","versionType":"custom","status":"affected","changes":[{"at":"0.17.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:57:30.407643Z","id":"CVE-2026-100508","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/two-factor/vulnerability/wordpress-two-factor-plugin-0-16-0-denial-of-service-attack-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-100513","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:15.350","lastModified":"2026-09-30T14:17:22.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Aman","product":"CF7 Views &#8211; Complete Entry Management for Contact Form 7","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"cf7-views","versions":[{"version":"n/a","lessThanOrEqual":"3.2.5","versionType":"custom","status":"affected","changes":[{"at":"3.2.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:57:21.348232Z","id":"CVE-2026-100513","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/cf7-views/vulnerability/wordpress-cf7-views-8211-complete-entry-management-for-contact-form-7-plugin-3-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102384","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:16.970","lastModified":"2026-09-30T14:17:23.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Supreme Modules","product":"Supreme Modules Lite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"supreme-modules-for-divi","versions":[{"version":"n/a","lessThanOrEqual":"2.5.63","versionType":"custom","status":"affected","changes":[{"at":"2.5.64","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.7,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:57:12.878437Z","id":"CVE-2026-102384","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/supreme-modules-for-divi/vulnerability/wordpress-supreme-modules-lite-plugin-2-5-63-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102385","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:17.107","lastModified":"2026-09-30T14:17:23.890","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Kevin Stover","product":"Ninja Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ninja-forms","versions":[{"version":"n/a","lessThanOrEqual":"3.15.3","versionType":"custom","status":"affected","changes":[{"at":"3.15.5","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:56:56.514383Z","id":"CVE-2026-102385","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ninja-forms/vulnerability/wordpress-ninja-forms-plugin-3-15-3-cross-site-scripting-xss-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102386","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:17.243","lastModified":"2026-09-30T14:17:24.023","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-photo-album-plus","versions":[{"version":"n/a","lessThanOrEqual":"9.3.02.003","versionType":"custom","status":"affected","changes":[{"at":"9.3.03.002","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:57:05.735812Z","id":"CVE-2026-102386","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-photo-album-plus/vulnerability/wordpress-wp-photo-album-plus-plugin-9-3-02-003-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102395","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:17.380","lastModified":"2026-09-30T14:17:24.150","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"supsystic","product":"Easy Google Maps","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"google-maps-easy","versions":[{"version":"n/a","lessThanOrEqual":"1.14.6","versionType":"custom","status":"affected","changes":[{"at":"1.15.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:56:46.223437Z","id":"CVE-2026-102395","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/google-maps-easy/vulnerability/wordpress-easy-google-maps-plugin-1-14-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102396","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:17.513","lastModified":"2026-09-30T14:17:24.277","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"supsystic","product":"Ultimate Maps by Supsystic","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ultimate-maps-by-supsystic","versions":[{"version":"n/a","lessThanOrEqual":"1.5.5","versionType":"custom","status":"affected","changes":[{"at":"1.6.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:56:38.510461Z","id":"CVE-2026-102396","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ultimate-maps-by-supsystic/vulnerability/wordpress-ultimate-maps-by-supsystic-plugin-1-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102398","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:17.647","lastModified":"2026-09-30T14:17:24.400","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"supsystic","product":"Popup by Supsystic","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"popup-by-supsystic","versions":[{"version":"n/a","lessThanOrEqual":"1.13.1","versionType":"custom","status":"affected","changes":[{"at":"1.13.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:12:12.801339Z","id":"CVE-2026-102398","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/popup-by-supsystic/vulnerability/wordpress-popup-by-supsystic-plugin-1-13-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102399","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:17.773","lastModified":"2026-09-30T14:17:24.513","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"supsystic","product":"Photo Gallery by Supsystic","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"gallery-by-supsystic","versions":[{"version":"n/a","lessThanOrEqual":"1.21.0","versionType":"custom","status":"affected","changes":[{"at":"1.21.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:56:26.178477Z","id":"CVE-2026-102399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/gallery-by-supsystic/vulnerability/wordpress-photo-gallery-by-supsystic-plugin-1-21-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103115","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T13:17:17.910","lastModified":"2026-10-02T17:17:01.490","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"OS4ED","product":"openSIS-Classic","cpes":["cpe:2.3:a:os4ed:opensis-classic:*:*:*:*:*:*:*:*"],"modules":["Student Search"],"versions":[{"version":"9.0","status":"affected"},{"version":"9.1","status":"affected"},{"version":"9.2","status":"affected"},{"version":"9.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:12:06.347810Z","id":"CVE-2026-103115","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/OS4ED/openSIS-Classic/","source":"cna@vuldb.com"},{"url":"https://github.com/OS4ED/openSIS-Classic/issues/475","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103115","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/954961","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411871","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411871/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103116","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T13:17:18.090","lastModified":"2026-09-30T17:16:41.723","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"OS4ED","product":"openSIS-Classic","cpes":["cpe:2.3:a:os4ed:opensis-classic:*:*:*:*:*:*:*:*"],"modules":["Student List Search Endpoint"],"versions":[{"version":"9.0","status":"affected"},{"version":"9.1","status":"affected"},{"version":"9.2","status":"affected"},{"version":"9.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:31:23.479633Z","id":"CVE-2026-103116","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/OS4ED/openSIS-Classic/","source":"cna@vuldb.com"},{"url":"https://github.com/OS4ED/openSIS-Classic/issues/476","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103116","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/954962","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411872","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411872/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103117","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T13:17:18.280","lastModified":"2026-09-30T14:17:27.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"OS4ED","product":"openSIS-Classic","cpes":["cpe:2.3:a:os4ed:opensis-classic:*:*:*:*:*:*:*:*"],"modules":["Save Data Handler"],"versions":[{"version":"9.0","status":"affected"},{"version":"9.1","status":"affected"},{"version":"9.2","status":"affected"},{"version":"9.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:41:28.622735Z","id":"CVE-2026-103117","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/OS4ED/openSIS-Classic/","source":"cna@vuldb.com"},{"url":"https://github.com/OS4ED/openSIS-Classic/issues/477","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103117","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/954963","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411873","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411873/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103321","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-30T13:17:18.463","lastModified":"2026-09-30T13:17:18.603","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.\n\nThe event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string concatenation, allowing a crafted value to break out of the attribute context and inject arbitrary script.\n\nPreconditions:\n\n- An authenticated MISP user with the ability to create or modify an event graph entry.\n\n- A second user (the victim) who views the event graph and triggers the preview popover.\n\nImpact:\n\n- Execution of arbitrary JavaScript in the victim's browser within the MISP application context.\n\n- Potential theft of session tokens, cookies, or sensitive data accessible to the victim's browser.\n\n- Potential for performing actions on behalf of the victim within the MISP application.\n\nAffected: MISP versions prior to the fix (commit applied after v2.5.48)."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"MISP","product":"MISP","cpes":["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"],"modules":["EventGraph model","event-graph.js client-side rendering"],"programFiles":["app/Model/EventGraph.php","app/webroot/js/event-graph.js"],"repo":"https://github.com/MISP/MISP","versions":[{"version":"0","lessThan":"2.5.48","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:44:13.205587Z","id":"CVE-2026-103321","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/MISP/MISP/commit/92c7ccc43","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-27085","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:18.773","lastModified":"2026-09-30T14:17:28.013","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Brainstorm Force","product":"Astra WordPress Theme","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/themes","packageName":"astra","versions":[{"version":"n/a","lessThanOrEqual":"4.13.12","versionType":"custom","status":"affected","changes":[{"at":"4.14.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:12:26.306404Z","id":"CVE-2026-27085","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/theme/astra/vulnerability/wordpress-astra-wordpress-theme-theme-4-13-12-content-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-27371","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:18.910","lastModified":"2026-09-30T14:17:28.143","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPFunnels","product":"WPFunnels","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpfunnels","versions":[{"version":"n/a","lessThanOrEqual":"3.13.1","versionType":"custom","status":"affected","changes":[{"at":"3.13.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:12:20.498473Z","id":"CVE-2026-27371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpfunnels/vulnerability/wordpress-wpfunnels-plugin-3-13-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62078","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:19.053","lastModified":"2026-09-30T14:17:28.290","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Leap13","product":"Premium Addons for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"premium-addons-for-elementor","versions":[{"version":"n/a","lessThanOrEqual":"4.11.105","versionType":"custom","status":"affected","changes":[{"at":"4.11.106","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:12:01.513576Z","id":"CVE-2026-62078","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-11-105-cross-site-scripting-xss-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62079","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:19.190","lastModified":"2026-09-30T14:17:28.430","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Qode","product":"Qi Addons For Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"qi-addons-for-elementor","versions":[{"version":"n/a","lessThanOrEqual":"1.11","versionType":"custom","status":"affected","changes":[{"at":"1.11.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:11:55.224131Z","id":"CVE-2026-62079","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/qi-addons-for-elementor/vulnerability/wordpress-qi-addons-for-elementor-plugin-1-11-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62080","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:19.327","lastModified":"2026-09-30T14:17:28.580","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Leevio","product":"Happy Addons for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"happy-elementor-addons","versions":[{"version":"n/a","lessThanOrEqual":"3.23.1","versionType":"custom","status":"affected","changes":[{"at":"3.50.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:11:40.821593Z","id":"CVE-2026-62080","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/happy-elementor-addons/vulnerability/wordpress-happy-addons-for-elementor-plugin-3-23-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62081","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:19.453","lastModified":"2026-09-30T14:17:28.720","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"wpdesk","product":"Flexible PDF Coupons","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"flexible-coupons","versions":[{"version":"n/a","lessThanOrEqual":"1.14.11","versionType":"custom","status":"affected","changes":[{"at":"1.14.12","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:13:10.303361Z","id":"CVE-2026-62081","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/flexible-coupons/vulnerability/wordpress-flexible-pdf-coupons-plugin-1-14-11-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62083","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:19.587","lastModified":"2026-09-30T14:17:28.860","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPFunnels","product":"Creator LMS","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"creatorlms","versions":[{"version":"n/a","lessThanOrEqual":"1.2.19","versionType":"custom","status":"affected","changes":[{"at":"1.2.20","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:10:26.798454Z","id":"CVE-2026-62083","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1284"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/creatorlms/vulnerability/wordpress-creator-lms-plugin-1-2-19-other-vulnerability-type-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62085","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:19.740","lastModified":"2026-09-30T14:17:29.010","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Administrator SQL Injection in WP Activity Log <= 5.6.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Melapress","product":"WP Activity Log","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-security-audit-log","versions":[{"version":"n/a","lessThanOrEqual":"5.6.6","versionType":"custom","status":"affected","changes":[{"at":"5.6.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:13:00.597788Z","id":"CVE-2026-62085","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-6-6-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-74864","sourceIdentifier":"cvd@cert.pl","published":"2026-09-30T13:17:19.913","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"sogo_yhn configures SOGo with a parameter that forces the request with HTTP header \"x-webobjects-remote-user\" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password.\n\n\n\n\nThis issue was fixed in version 5.8.0~ynh9."}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"YunoHost-Apps","product":"sogo_yhn","defaultStatus":"unaffected","repo":"https://github.com/YunoHost-Apps/sogo_ynh","versions":[{"version":"0","lessThan":"5.8.0~ynh9","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:50:42.911688Z","id":"CVE-2026-74864","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://cert.pl/en/posts/2026/09/CVE-2026-74864","source":"cvd@cert.pl"},{"url":"https://forum.yunohost.org/t/sogo-critical-vulnerability-fixed-in-5-8-0-ynh9/42699","source":"cvd@cert.pl"}]}},{"cve":{"id":"CVE-2026-74865","sourceIdentifier":"cvd@cert.pl","published":"2026-09-30T13:17:20.083","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"sogo_yhn configures SOGo with a parameter \"SOGoTrustProxyAuthentication=YES\". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account.\n\n\nThis issue was fixed in version 5.8.0~ynh9."}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"YunoHost-Apps","product":"sogo_yhn","defaultStatus":"unaffected","repo":"https://github.com/YunoHost-Apps/sogo_ynh","versions":[{"version":"0","lessThan":"5.8.0~ynh9","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:50:17.073137Z","id":"CVE-2026-74865","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://cert.pl/en/posts/2026/09/CVE-2026-74864","source":"cvd@cert.pl"},{"url":"https://forum.yunohost.org/t/sogo-critical-vulnerability-fixed-in-5-8-0-ynh9/42699","source":"cvd@cert.pl"}]}},{"cve":{"id":"CVE-2026-76504","sourceIdentifier":"psirt@cisco.com","published":"2026-09-30T13:17:20.247","lastModified":"2026-10-03T00:16:39.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.\r\n\r\nThis vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user."}],"affected":[{"source":"psirt@cisco.com","affectedData":[{"vendor":"Cisco","product":"Cisco Catalyst SD-WAN Manager","defaultStatus":"unknown","versions":[{"version":"20.1.12","status":"affected"},{"version":"19.2.1","status":"affected"},{"version":"18.4.4","status":"affected"},{"version":"18.4.5","status":"affected"},{"version":"20.1.1.1","status":"affected"},{"version":"20.1.1","status":"affected"},{"version":"19.3.0","status":"affected"},{"version":"19.2.2","status":"affected"},{"version":"19.2.099","status":"affected"},{"version":"18.3.6","status":"affected"},{"version":"18.3.7","status":"affected"},{"version":"19.2.0","status":"affected"},{"version":"18.3.8","status":"affected"},{"version":"19.0.0","status":"affected"},{"version":"19.1.0","status":"affected"},{"version":"18.4.302","status":"affected"},{"version":"18.4.303","status":"affected"},{"version":"19.2.097","status":"affected"},{"version":"19.2.098","status":"affected"},{"version":"17.2.10","status":"affected"},{"version":"18.3.6.1","status":"affected"},{"version":"19.0.1a","status":"affected"},{"version":"18.2.0","status":"affected"},{"version":"18.4.3","status":"affected"},{"version":"18.4.1","status":"affected"},{"version":"17.2.8","status":"affected"},{"version":"18.3.3.1","status":"affected"},{"version":"18.4.0","status":"affected"},{"version":"18.3.1","status":"affected"},{"version":"17.2.6","status":"affected"},{"version":"17.2.9","status":"affected"},{"version":"18.3.4","status":"affected"},{"version":"17.2.5","status":"affected"},{"version":"18.3.1.1","status":"affected"},{"version":"18.3.5","status":"affected"},{"version":"18.4.0.1","status":"affected"},{"version":"18.3.3","status":"affected"},{"version":"17.2.7","status":"affected"},{"version":"17.2.4","status":"affected"},{"version":"18.3.0","status":"affected"},{"version":"19.2.3","status":"affected"},{"version":"18.4.501_ES","status":"affected"},{"version":"20.3.1","status":"affected"},{"version":"20.1.2","status":"affected"},{"version":"19.2.929","status":"affected"},{"version":"19.2.31","status":"affected"},{"version":"20.3.2","status":"affected"},{"version":"19.2.32","status":"affected"},{"version":"20.3.2_925","status":"affected"},{"version":"20.3.2.1","status":"affected"},{"version":"20.3.2.1_927","status":"affected"},{"version":"18.4.6","status":"affected"},{"version":"20.1.2_937","status":"affected"},{"version":"20.4.1","status":"affected"},{"version":"20.3.2_928","status":"affected"},{"version":"20.3.2_929","status":"affected"},{"version":"20.4.1.0.1","status":"affected"},{"version":"20.3.2.1_930","status":"affected"},{"version":"19.2.4","status":"affected"},{"version":"20.5.0.1.1","status":"affected"},{"version":"20.4.1.1","status":"affected"},{"version":"20.3.3","status":"affected"},{"version":"19.2.4.0.1","status":"affected"},{"version":"20.3.2_937","status":"affected"},{"version":"20.3.3.1","status":"affected"},{"version":"20.5.1","status":"affected"},{"version":"20.1.3","status":"affected"},{"version":"20.3.3.0.4","status":"affected"},{"version":"20.3.3.1.2","status":"affected"},{"version":"20.3.3.1.1","status":"affected"},{"version":"20.4.1.2","status":"affected"},{"version":"20.3.3.0.2","status":"affected"},{"version":"20.4.1.1.5","status":"affected"},{"version":"20.4.1.0.01","status":"affected"},{"version":"20.4.1.0.02","status":"affected"},{"version":"20.3.3.1.7","status":"affected"},{"version":"20.3.3.1.5","status":"affected"},{"version":"20.5.1.0.1","status":"affected"},{"version":"20.3.3.1.10","status":"affected"},{"version":"20.3.3.0.8","status":"affected"},{"version":"20.4.2","status":"affected"},{"version":"20.4.2.0.1","status":"affected"},{"version":"20.3.4","status":"affected"},{"version":"20.3.3.0.14","status":"affected"},{"version":"19.2.4.0.8","status":"affected"},{"version":"19.2.4.0.9","status":"affected"},{"version":"20.3.4.0.1","status":"affected"},{"version":"20.3.2.0.5","status":"affected"},{"version":"20.6.1","status":"affected"},{"version":"20.5.1.0.2","status":"affected"},{"version":"20.3.3.0.17","status":"affected"},{"version":"20.6.1.1","status":"affected"},{"version":"20.6.0.18.3","status":"affected"},{"version":"20.3.2.0.6","status":"affected"},{"version":"20.6.0.18.4","status":"affected"},{"version":"20.4.2.0.2","status":"affected"},{"version":"20.3.3.0.16","status":"affected"},{"version":"20.3.4.0.5","status":"affected"},{"version":"20.6.1.0.1","status":"affected"},{"version":"20.3.4.0.6","status":"affected"},{"version":"20.6.2","status":"affected"},{"version":"20.7.1EFT2","status":"affected"},{"version":"20.3.4.0.9","status":"affected"},{"version":"20.3.4.0.11","status":"affected"},{"version":"20.4.2.0.4","status":"affected"},{"version":"20.3.3.0.18","status":"affected"},{"version":"20.7.1","status":"affected"},{"version":"20.6.2.1","status":"affected"},{"version":"20.3.4.1","status":"affected"},{"version":"20.5.1.1","status":"affected"},{"version":"20.4.2.1","status":"affected"},{"version":"20.4.2.1.1","status":"affected"},{"version":"20.3.4.1.1","status":"affected"},{"version":"20.3.813","status":"affected"},{"version":"20.3.4.0.19","status":"affected"},{"version":"20.4.2.2.1","status":"affected"},{"version":"20.5.1.2","status":"affected"},{"version":"20.3.4.2","status":"affected"},{"version":"20.3.814","status":"affected"},{"version":"20.4.2.2","status":"affected"},{"version":"20.6.2.2","status":"affected"},{"version":"20.3.4.2.1","status":"affected"},{"version":"20.7.1.1","status":"affected"},{"version":"20.3.4.1.2","status":"affected"},{"version":"20.6.2.2.2","status":"affected"},{"version":"20.3.4.0.20","status":"affected"},{"version":"20.6.2.2.3","status":"affected"},{"version":"20.4.2.2.2","status":"affected"},{"version":"20.3.5","status":"affected"},{"version":"20.6.2.0.4","status":"affected"},{"version":"20.4.2.2.3","status":"affected"},{"version":"20.3.4.0.24","status":"affected"},{"version":"20.6.2.2.7","status":"affected"},{"version":"20.6.3","status":"affected"},{"version":"20.3.4.2.2","status":"affected"},{"version":"20.4.2.2.4","status":"affected"},{"version":"20.7.1.0.2","status":"affected"},{"version":"20.8.1","status":"affected"},{"version":"20.3.5.0.8","status":"affected"},{"version":"20.3.5.0.9","status":"affected"},{"version":"20.4.2.2.8","status":"affected"},{"version":"20.3.5.0.7","status":"affected"},{"version":"20.6.3.0.7","status":"affected"},{"version":"20.6.3.0.5","status":"affected"},{"version":"20.6.3.0.10","status":"affected"},{"version":"20.6.3.0.2","status":"affected"},{"version":"20.7.2","status":"affected"},{"version":"20.9.1EFT2","status":"affected"},{"version":"20.6.3.0.11","status":"affected"},{"version":"20.6.3.1","status":"affected"},{"version":"20.6.3.0.14","status":"affected"},{"version":"20.6.4","status":"affected"},{"version":"20.9.1","status":"affected"},{"version":"20.6.3.0.19","status":"affected"},{"version":"20.6.3.0.18","status":"affected"},{"version":"20.3.6","status":"affected"},{"version":"20.9.1.1","status":"affected"},{"version":"20.6.3.0.23","status":"affected"},{"version":"20.6.4.0.4","status":"affected"},{"version":"20.6.3.0.25","status":"affected"},{"version":"20.6.5","status":"affected"},{"version":"20.6.3.0.27","status":"affected"},{"version":"20.9.2","status":"affected"},{"version":"20.9.2.1","status":"affected"},{"version":"20.6.3.0.29","status":"affected"},{"version":"20.6.3.0.31","status":"affected"},{"version":"20.6.3.0.32","status":"affected"},{"version":"20.10.1","status":"affected"},{"version":"20.6.3.0.33","status":"affected"},{"version":"20.9.2.0.01","status":"affected"},{"version":"20.9.1_LI_Images","status":"affected"},{"version":"20.10.1_LI_Images","status":"affected"},{"version":"20.9.2_LI_Images","status":"affected"},{"version":"20.3.7","status":"affected"},{"version":"20.9.3","status":"affected"},{"version":"20.6.5.1","status":"affected"},{"version":"20.11.1","status":"affected"},{"version":"20.11.1_LI_Images","status":"affected"},{"version":"20.9.3_LI_ Images","status":"affected"},{"version":"20.6.3.1.1","status":"affected"},{"version":"20.9.3.0.2","status":"affected"},{"version":"20.6.5.1.2","status":"affected"},{"version":"20.9.3.0.3","status":"affected"},{"version":"20.4.2.3","status":"affected"},{"version":"20.6.3.2","status":"affected"},{"version":"20.6.4.1","status":"affected"},{"version":"20.6.3.0.38","status":"affected"},{"version":"20.6.3.0.39","status":"affected"},{"version":"20.3.5.1","status":"affected"},{"version":"20.3.4.3","status":"affected"},{"version":"20.9.3.1","status":"affected"},{"version":"20.3.3.2","status":"affected"},{"version":"20.6.5.2","status":"affected"},{"version":"20.3.7.1","status":"affected"},{"version":"20.10.1.1","status":"affected"},{"version":"20.6.5.2.1","status":"affected"},{"version":"20.3.4.0.25","status":"affected"},{"version":"20.6.2.2.4","status":"affected"},{"version":"20.6.1.2","status":"affected"},{"version":"20.11.1.1","status":"affected"},{"version":"20.9.3.0.5","status":"affected"},{"version":"20.3.4.0.26","status":"affected"},{"version":"20.6.5.1.3","status":"affected"},{"version":"20.6.3.0.40","status":"affected"},{"version":"20.1.3.1","status":"affected"},{"version":"20.9.2.2","status":"affected"},{"version":"20.6.5.2.3","status":"affected"},{"version":"20.6.5.1.4","status":"affected"},{"version":"20.6.5.3","status":"affected"},{"version":"20.6.3.0.41","status":"affected"},{"version":"20.9.3.0.7","status":"affected"},{"version":"20.6.5.1.5","status":"affected"},{"version":"20.9.3.0.4","status":"affected"},{"version":"20.6.4.0.19","status":"affected"},{"version":"20.6.5.1.6","status":"affected"},{"version":"20.9.3.0.8","status":"affected"},{"version":"20.6.3.3","status":"affected"},{"version":"20.3.7.2","status":"affected"},{"version":"20.6.5.4","status":"affected"},{"version":"20.6.5.1.7","status":"affected"},{"version":"20.9.3.0.12","status":"affected"},{"version":"20.6.4.2","status":"affected"},{"version":"20.6.5.5","status":"affected"},{"version":"20.9.3.2","status":"affected"},{"version":"20.11.1.2","status":"affected"},{"version":"20.6.3.4","status":"affected"},{"version":"20.10.1.2","status":"affected"},{"version":"20.6.5.1.9","status":"affected"},{"version":"20.9.3.0.16","status":"affected"},{"version":"20.6.3.0.45","status":"affected"},{"version":"20.6.5.1.10","status":"affected"},{"version":"20.9.3.0.17","status":"affected"},{"version":"20.6.5.2.4","status":"affected"},{"version":"20.6.4.0.21","status":"affected"},{"version":"20.9.3.0.18","status":"affected"},{"version":"20.6.3.0.46","status":"affected"},{"version":"20.6.3.0.47","status":"affected"},{"version":"20.9.2.3","status":"affected"},{"version":"20.9.3.2_LI_Images","status":"affected"},{"version":"20.9.3.0.21","status":"affected"},{"version":"20.9.3.0.20","status":"affected"},{"version":"20.9.4_LI_Images","status":"affected"},{"version":"20.9.4","status":"affected"},{"version":"20.6.5.1.11","status":"affected"},{"version":"20.12.1","status":"affected"},{"version":"20.12.1_LI_Images","status":"affected"},{"version":"20.6.5.1.13","status":"affected"},{"version":"20.9.3.0.23","status":"affected"},{"version":"20.6.5.2.8","status":"affected"},{"version":"20.9.4.1","status":"affected"},{"version":"20.9.4.1_LI_Images","status":"affected"},{"version":"20.9.3.0.25","status":"affected"},{"version":"20.9.3.0.24","status":"affected"},{"version":"20.6.5.1.14","status":"affected"},{"version":"20.3.8","status":"affected"},{"version":"20.6.6","status":"affected"},{"version":"20.9.3.0.26","status":"affected"},{"version":"20.6.3.0.51","status":"affected"},{"version":"20.9.3.0.29","status":"affected"},{"version":"20.12.2","status":"affected"},{"version":"20.12.2_LI_Images","status":"affected"},{"version":"20.6.6.0.1","status":"affected"},{"version":"20.13.1_LI_Images","status":"affected"},{"version":"20.9.4.0.4","status":"affected"},{"version":"20.13.1","status":"affected"},{"version":"20.9.4.1.1","status":"affected"},{"version":"20.9.5","status":"affected"},{"version":"20.9.5_LI_Images","status":"affected"},{"version":"20.12.3_LI_Images","status":"affected"},{"version":"20.12.3","status":"affected"},{"version":"20.9.4.1.3","status":"affected"},{"version":"20.6.7","status":"affected"},{"version":"20.9.5.1","status":"affected"},{"version":"20.9.5.1_LI_Images","status":"affected"},{"version":"20.9.4.1.6","status":"affected"},{"version":"20.14.1","status":"affected"},{"version":"20.14.1_LI_Images","status":"affected"},{"version":"20.9.5.2","status":"affected"},{"version":"20.9.5.2.1","status":"affected"},{"version":"20.9.5.2_LI_Images","status":"affected"},{"version":"20.12.3.1","status":"affected"},{"version":"20.12.4","status":"affected"},{"version":"20.15.1_LI_Images","status":"affected"},{"version":"20.15.1","status":"affected"},{"version":"20.9.5.1.4","status":"affected"},{"version":"20.9.5.2.7","status":"affected"},{"version":"20.9.5.2.13","status":"affected"},{"version":"20.9.6","status":"affected"},{"version":"20.9.6_LI_Images","status":"affected"},{"version":"20.9.5.2.14","status":"affected"},{"version":"20.6.8","status":"affected"},{"version":"20.12.4.0.03","status":"affected"},{"version":"20.16.1","status":"affected"},{"version":"20.16.1_LI_Images","status":"affected"},{"version":"20.12.4_LI_Images","status":"affected"},{"version":"20.9.5.2.16","status":"affected"},{"version":"20.12.4.0.4","status":"affected"},{"version":"20.12.401","status":"affected"},{"version":"20.9.5.3","status":"affected"},{"version":"20.9.5.3_LI_Images","status":"affected"},{"version":"20.12.4.1_LI_Images","status":"affected"},{"version":"20.12.4.1","status":"affected"},{"version":"20.9.5.2.21","status":"affected"},{"version":"20.9.6.0.3","status":"affected"},{"version":"20.12.4.0.6","status":"affected"},{"version":"20.15.2_LI_Images","status":"affected"},{"version":"20.15.2","status":"affected"},{"version":"20.12.4_Monthly_ES5","status":"affected"},{"version":"20.12.5","status":"affected"},{"version":"20.12.5_LI_Images","status":"affected"},{"version":"20.9.7_LI _Images","status":"affected"},{"version":"20.9.7","status":"affected"},{"version":"20.15.3","status":"affected"},{"version":"20.15.3_ LI _Images","status":"affected"},{"version":"20.12.501","status":"affected"},{"version":"20.12.5.1_LI_Images","status":"affected"},{"version":"20.12.5.1","status":"affected"},{"version":"20.12.5.2_LI_Images","status":"affected"},{"version":"20.12.5.2","status":"affected"},{"version":"20.15.3.1","status":"affected"},{"version":"20.15.4_LI_Images","status":"affected"},{"version":"20.15.4","status":"affected"},{"version":"20.9.7.1_LI _Images","status":"affected"},{"version":"20.9.7.1","status":"affected"},{"version":"20.18.1","status":"affected"},{"version":"20.18.1_LI_Images","status":"affected"},{"version":"20.12.6_LI_Images","status":"affected"},{"version":"20.12.6","status":"affected"},{"version":"20.12.5.1.01","status":"affected"},{"version":"26.0.1","status":"affected"},{"version":"20.9.8","status":"affected"},{"version":"20.9.8_LI_Images","status":"affected"},{"version":"20.18.2","status":"affected"},{"version":"20.15.4.1_LI_Images","status":"affected"},{"version":"20.15.4.1","status":"affected"},{"version":"20.18.2_LI_Images","status":"affected"},{"version":"26.1.1","status":"affected"},{"version":"26.1.1_LI_Images","status":"affected"},{"version":"20.18.2.1_LI_Images","status":"affected"},{"version":"20.18.2.1","status":"affected"},{"version":"20.15.4.2_LI_Images","status":"affected"},{"version":"20.15.4.2","status":"affected"},{"version":"20.12.6.1","status":"affected"},{"version":"20.12.6.1_LI_Images","status":"affected"},{"version":"20.12.5.3","status":"affected"},{"version":"20.12.5.3_LI_Images","status":"affected"},{"version":"20.9.8.2_LI_Images","status":"affected"},{"version":"20.9.8.2","status":"affected"},{"version":"20.18.3","status":"affected"},{"version":"20.18.3_LI_Images","status":"affected"},{"version":"20.15.5","status":"affected"},{"version":"20.15.5_LI_Images","status":"affected"},{"version":"20.12.7","status":"affected"},{"version":"20.12.7_LI_Images","status":"affected"},{"version":"20.9.9","status":"affected"},{"version":"20.9.9_LI_Images","status":"affected"},{"version":"20.18.2.2","status":"affected"},{"version":"20.18.2.2_LI_Images","status":"affected"},{"version":"20.12.5.4","status":"affected"},{"version":"20.12.5.4_LI_ Images","status":"affected"},{"version":"20.12.7.1_LI_Images","status":"affected"},{"version":"20.12.6.2_LI_Images","status":"affected"},{"version":"20.12.7.1","status":"affected"},{"version":"20.15.5.1","status":"affected"},{"version":"20.15.4.3","status":"affected"},{"version":"20.15.4.3_LI_Images","status":"affected"},{"version":"20.15.5.1_LI_Images","status":"affected"},{"version":"20.12.6.2","status":"affected"},{"version":"20.15.5.2","status":"affected"},{"version":"20.15.5.2_LI_Images","status":"affected"},{"version":"26.1.1.1_LI_Images","status":"affected"},{"version":"20.15.4.4","status":"affected"},{"version":"20.15.4.4_LI_Images","status":"affected"},{"version":"26.1.1.1","status":"affected"},{"version":"20.9.9.1_LI_Images","status":"affected"},{"version":"20.9.9.1","status":"affected"},{"version":"20.18.3.1_LI_Images","status":"affected"},{"version":"20.18.3.1","status":"affected"},{"version":"26.1.1.2","status":"affected"},{"version":"26.1.1.2_LI_Images","status":"affected"},{"version":"20.15.4.5","status":"affected"},{"version":"20.15.4.5_LI_Images","status":"affected"},{"version":"20.15.5.3","status":"affected"},{"version":"20.15.5.3_LI_Images","status":"affected"},{"version":"20.12.7.2_LI_Images","status":"affected"},{"version":"20.12.7.2","status":"affected"},{"version":"20.9.9.2","status":"affected"},{"version":"20.9.9.2_LI_Images","status":"affected"},{"version":"20.15.6","status":"affected"},{"version":"20.15.6_LI_Images","status":"affected"},{"version":"20.18.4_LI_Imagess","status":"affected"},{"version":"20.18.4","status":"affected"},{"version":"20.12.8","status":"affected"},{"version":"20.12.8_LI_Images","status":"affected"},{"version":"20.18.4_LI_Images","status":"affected"},{"version":"20.12.8.1","status":"affected"},{"version":"20.12.8.1_LI_Images","status":"affected"},{"version":"20.9.10_LI_Images","status":"affected"},{"version":"20.9.10","status":"affected"},{"version":"26.1.2_LI_Images","status":"affected"},{"version":"26.1.2","status":"affected"},{"version":"20.15.6.0.5_PSIRTAUG","status":"affected"},{"version":"20.18.4.0.5_PSIRTAUG","status":"affected"},{"version":"20.12.8.1.1","status":"affected"},{"version":"20.9.10.0.01","status":"affected"},{"version":"26.1.2.0.02","status":"affected"},{"version":"26.2.1_LI_Images","status":"affected"},{"version":"20.18.4.1.01","status":"affected"},{"version":"26.1.2.1_LI_Images","status":"affected"},{"version":"20.15.6.1_LI_Images","status":"affected"},{"version":"20.18.4.1_LI_Images","status":"affected"},{"version":"20.9.10.1.01","status":"affected"},{"version":"20.15.6.1.01","status":"affected"},{"version":"26.1.2.1.01","status":"affected"},{"version":"20.12.8.2.01","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-76504","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-09-30","cisaActionDue":"2026-10-03","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","weaknesses":[{"source":"psirt@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-177"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"20.9.10.1","matchCriteriaId":"77568CB9-9932-4E34-80AE-8F3907FD1108"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"20.12","versionEndExcluding":"20.12.8.2","matchCriteriaId":"0718434D-8D5C-4C3B-9A5A-E51E00FAF08E"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"20.15","versionEndExcluding":"20.15.6.1","matchCriteriaId":"A18803AF-4543-48CF-B285-491D299B9E4F"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"20.18","versionEndExcluding":"20.18.4.1","matchCriteriaId":"2C2E5FDB-3377-486E-A162-CC41CEDD6407"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"26.1","versionEndExcluding":"26.1.2.1","matchCriteriaId":"C3146F9A-A6CB-43C0-83D5-65E86E733459"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:catalyst_sd-wan_manager:26.2:*:*:*:*:*:*:*","matchCriteriaId":"AF723B33-8BE6-4A8D-B156-28CC3EB3A87B"}]}]}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU","source":"psirt@cisco.com","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}},{"cve":{"id":"CVE-2026-86778","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-30T13:17:21.207","lastModified":"2026-09-30T16:18:57.403","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting.\n\nThis issue affects Maksisoft Gym: from 0.5.10 before 0.5.11."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"Maksisoft Technology, IT, and Software Industry and Trade Inc.","product":"Maksisoft Gym","defaultStatus":"unaffected","versions":[{"version":"0.5.10","lessThan":"0.5.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:26:40.478516Z","id":"CVE-2026-86778","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-204"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1223","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-89238","sourceIdentifier":"security@apache.org","published":"2026-09-30T13:17:21.587","lastModified":"2026-10-06T17:26:05.287","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache WSS4J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wss4j:wss4j-ws-security-dom","packageURL":"pkg:maven/org.apache.wss4j/wss4j-ws-security-dom","versions":[{"version":"4.0.0","lessThan":"4.0.2","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.6","versionType":"semver","status":"affected"},{"version":"0","lessThan":"2.4.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:49:38.121856Z","id":"CVE-2026-89238","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.4","matchCriteriaId":"A3409718-5467-407D-9B51-14E58B6D2F68"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.6","matchCriteriaId":"31AFF243-7BCE-44BC-85C5-6FE257642C13"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.2","matchCriteriaId":"20E76C98-444D-4DB5-91E0-90E84C196158"}]}]}],"references":[{"url":"https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/11","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-92121","sourceIdentifier":"security@apache.org","published":"2026-09-30T13:17:21.710","lastModified":"2026-10-06T17:22:23.020","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal \"inside signed content\" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. Signature verification itself is unaffected. The DOM code is not affected. \nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4 which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache WSS4J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wss4j:wss4j-ws-security-stax","packageURL":"pkg:maven/org.apache.wss4j/wss4j-ws-security-stax","versions":[{"version":"4.0.0","lessThan":"4.0.2","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.6","versionType":"semver","status":"affected"},{"version":"0","lessThan":"2.4.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:51:12.918380Z","id":"CVE-2026-92121","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.4","matchCriteriaId":"A3409718-5467-407D-9B51-14E58B6D2F68"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.6","matchCriteriaId":"31AFF243-7BCE-44BC-85C5-6FE257642C13"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.2","matchCriteriaId":"20E76C98-444D-4DB5-91E0-90E84C196158"}]}]}],"references":[{"url":"https://lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/12","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-92899","sourceIdentifier":"security@apache.org","published":"2026-09-30T13:17:21.823","lastModified":"2026-10-02T20:18:52.007","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticated request could re-send it with a space added to the Nonce: the password digest still verified, but the token no longer matched the remembered one, so the replay was accepted. Since a UsernameToken does not cover the message body, the captured token could then be reused on requests of the attacker's choosing until it expired. Affects deployments with a nonce replay cache configured, as Apache CXF has by default, and only tokens using a password digest. The cache is now keyed on the decoded Nonce. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache WSS4J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wss4j:wss4j-ws-security-dom","packageURL":"pkg:/maven/org.apache.wss4j/wss4j-ws-security-dom","versions":[{"version":"4.0.0","lessThan":"4.0.2","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.6","versionType":"semver","status":"affected"},{"version":"0","lessThan":"2.4.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:49:54.166060Z","id":"CVE-2026-92899","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.4","matchCriteriaId":"A3409718-5467-407D-9B51-14E58B6D2F68"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.6","matchCriteriaId":"31AFF243-7BCE-44BC-85C5-6FE257642C13"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.2","matchCriteriaId":"20E76C98-444D-4DB5-91E0-90E84C196158"}]}]}],"references":[{"url":"https://lists.apache.org/thread.html/nrzngsz1xm2lztq3t873663xx9wnrwm7","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/13","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-93512","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:21.997","lastModified":"2026-09-30T14:17:34.733","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ilGhera","product":"JW Player for WordPress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"jw-player-7-for-wp","versions":[{"version":"n/a","lessThanOrEqual":"2.3.11","versionType":"custom","status":"affected","changes":[{"at":"2.3.12","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:10:13.282444Z","id":"CVE-2026-93512","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jw-player-7-for-wp/vulnerability/wordpress-jw-player-for-wordpress-plugin-2-3-11-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93514","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:22.130","lastModified":"2026-09-30T14:17:34.860","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"rainafarai","product":"Notification for Telegram","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"notification-for-telegram","versions":[{"version":"n/a","lessThanOrEqual":"3.5.2","versionType":"custom","status":"affected","changes":[{"at":"3.5.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:12:56.036040Z","id":"CVE-2026-93514","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/notification-for-telegram/vulnerability/wordpress-notification-for-telegram-plugin-3-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93621","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:22.267","lastModified":"2026-09-30T14:17:35.490","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Passionate Programmer Peter","product":"WP Data Access","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-data-access","versions":[{"version":"n/a","lessThanOrEqual":"5.5.84","versionType":"custom","status":"affected","changes":[{"at":"5.5.85","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:07:37.648291Z","id":"CVE-2026-93621","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-data-access/vulnerability/wordpress-wp-data-access-plugin-5-5-84-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93624","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:22.407","lastModified":"2026-09-30T14:17:35.677","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"codepeople","product":"Music Player for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"music-player-for-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"1.9.1","versionType":"custom","status":"affected","changes":[{"at":"1.9.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:07:28.748726Z","id":"CVE-2026-93624","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/music-player-for-woocommerce/vulnerability/wordpress-music-player-for-woocommerce-plugin-1-9-1-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93651","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:22.543","lastModified":"2026-09-30T14:17:36.093","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Dotstore","product":"Minimum and Maximum Quantity for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"min-and-max-quantity-for-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"2.1.2","versionType":"custom","status":"affected","changes":[{"at":"2.1.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:07:23.926331Z","id":"CVE-2026-93651","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/min-and-max-quantity-for-woocommerce/vulnerability/wordpress-minimum-and-maximum-quantity-for-woocommerce-plugin-2-1-2-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93770","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:22.677","lastModified":"2026-09-30T14:17:36.387","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"VeronaLabs","product":"WP Statistics","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-statistics","versions":[{"version":"n/a","lessThanOrEqual":"14.16.13","versionType":"custom","status":"affected","changes":[{"at":"14.16.14","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:07:17.730453Z","id":"CVE-2026-93770","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-statistics/vulnerability/wordpress-wp-statistics-plugin-14-16-13-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93771","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:22.810","lastModified":"2026-09-30T14:17:36.747","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPFactory","product":"Cost of Goods for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"cost-of-goods-for-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"3.5.2","versionType":"custom","status":"affected","changes":[{"at":"4.2.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:07:11.235182Z","id":"CVE-2026-93771","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/cost-of-goods-for-woocommerce/vulnerability/wordpress-cost-of-goods-for-woocommerce-plugin-3-5-2-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94074","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:22.947","lastModified":"2026-09-30T14:17:37.453","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"NSquared","product":"Simply Schedule Appointments","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"simply-schedule-appointments","versions":[{"version":"n/a","lessThanOrEqual":"1.6.12.29","versionType":"custom","status":"affected","changes":[{"at":"1.6.12.31","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:07:05.942444Z","id":"CVE-2026-94074","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-12-29-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94076","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:23.080","lastModified":"2026-09-30T14:17:37.710","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"SEO Squirrly","product":"SEO Plugin by Squirrly SEO","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"squirrly-seo","versions":[{"version":"n/a","lessThanOrEqual":"14.2.5","versionType":"custom","status":"affected","changes":[{"at":"14.2.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:06:58.073391Z","id":"CVE-2026-94076","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/squirrly-seo/vulnerability/wordpress-seo-plugin-by-squirrly-seo-plugin-14-2-5-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94077","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:23.210","lastModified":"2026-09-30T14:17:38.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"10up","product":"Safe SVG","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"safe-svg","versions":[{"version":"n/a","lessThanOrEqual":"2.5.0","versionType":"custom","status":"affected","changes":[{"at":"2.5.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:06:51.244855Z","id":"CVE-2026-94077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/safe-svg/vulnerability/wordpress-safe-svg-plugin-2-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94078","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:23.350","lastModified":"2026-09-30T14:17:38.423","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Gemini Labs","product":"Site Reviews","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"site-reviews","versions":[{"version":"n/a","lessThanOrEqual":"8.3.1","versionType":"custom","status":"affected","changes":[{"at":"8.3.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:06:45.448283Z","id":"CVE-2026-94078","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/site-reviews/vulnerability/wordpress-site-reviews-plugin-8-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94081","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:23.523","lastModified":"2026-09-30T14:17:38.790","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"lukeseager","product":"WordPress Persistent Login","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-persistent-login","versions":[{"version":"n/a","lessThanOrEqual":"3.1.3","versionType":"custom","status":"affected","changes":[{"at":"3.1.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:06:31.149632Z","id":"CVE-2026-94081","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-persistent-login/vulnerability/wordpress-wordpress-persistent-login-plugin-3-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94082","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:24.093","lastModified":"2026-09-30T14:17:39.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Author SQL Injection in Quiz Cat <= 3.1.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Fatcatapps","product":"Quiz Cat","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"quiz-cat","versions":[{"version":"n/a","lessThanOrEqual":"3.1.1","versionType":"custom","status":"affected","changes":[{"at":"3.2.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:10:09.370463Z","id":"CVE-2026-94082","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/quiz-cat/vulnerability/wordpress-quiz-cat-plugin-3-1-1-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94115","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:24.227","lastModified":"2026-09-30T14:17:39.703","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Fatcatapps","product":"Easy Pricing Tables","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"easy-pricing-tables","versions":[{"version":"n/a","lessThanOrEqual":"4.1.2","versionType":"custom","status":"affected","changes":[{"at":"4.1.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:10:04.472398Z","id":"CVE-2026-94115","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/easy-pricing-tables/vulnerability/wordpress-easy-pricing-tables-plugin-4-1-2-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94120","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:24.363","lastModified":"2026-09-30T14:17:40.260","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"GravityKit","product":"GravityExport Lite for Gravity Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"gf-entries-in-excel","versions":[{"version":"n/a","lessThanOrEqual":"2.7.2","versionType":"custom","status":"affected","changes":[{"at":"2.7.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:09:56.765280Z","id":"CVE-2026-94120","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/gf-entries-in-excel/vulnerability/wordpress-gravityexport-lite-for-gravity-forms-plugin-2-7-2-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94121","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:24.497","lastModified":"2026-09-30T14:17:40.487","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"10Web","product":"10Web Booster – Website speed optimization, Cache & Page Speed optimizer","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"tenweb-speed-optimizer","versions":[{"version":"n/a","lessThanOrEqual":"2.33.6","versionType":"custom","status":"affected","changes":[{"at":"2.34.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:09:48.942416Z","id":"CVE-2026-94121","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/tenweb-speed-optimizer/vulnerability/wordpress-10web-booster-website-speed-optimization-cache-page-speed-optimizer-plugin-2-33-6-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94122","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:24.700","lastModified":"2026-09-30T14:17:40.727","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Editor PHP Object Injection in Responsive Slider Gallery  <= 1.5.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"A WP Life","product":"Responsive Slider Gallery","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"responsive-slider-gallery","versions":[{"version":"n/a","lessThanOrEqual":"1.5.5","versionType":"custom","status":"affected","changes":[{"at":"1.5.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:09:43.625148Z","id":"CVE-2026-94122","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/responsive-slider-gallery/vulnerability/wordpress-responsive-slider-gallery-plugin-1-5-5-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94123","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:25.000","lastModified":"2026-09-30T14:17:40.940","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Syed Balkhi","product":"NextGEN Gallery","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"nextgen-gallery","versions":[{"version":"n/a","lessThanOrEqual":"4.5.0","versionType":"custom","status":"affected","changes":[{"at":"4.5.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:12:52.118389Z","id":"CVE-2026-94123","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/nextgen-gallery/vulnerability/wordpress-nextgen-gallery-plugin-4-5-0-arbitrary-file-download-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94173","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:25.263","lastModified":"2026-09-30T14:17:41.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Strategy11 Team","product":"Business Directory","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"business-directory-plugin","versions":[{"version":"n/a","lessThanOrEqual":"6.4.27","versionType":"custom","status":"affected","changes":[{"at":"6.4.28","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:12:45.449256Z","id":"CVE-2026-94173","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/business-directory-plugin/vulnerability/wordpress-business-directory-plugin-6-4-27-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94177","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:25.583","lastModified":"2026-10-17T09:16:29.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Ruben Garcia","product":"GamiPress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"gamipress","versions":[{"version":"0","lessThanOrEqual":"8.0.2","versionType":"custom","status":"affected","changes":[{"at":"8.0.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:12:40.471199Z","id":"CVE-2026-94177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/gamipress/vulnerability/wordpress-gamipress-plugin-8-0-2-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94178","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:25.953","lastModified":"2026-09-30T14:17:43.553","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Javier Carazo","product":"Import and export users and customers","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"import-users-from-csv-with-meta","versions":[{"version":"n/a","lessThanOrEqual":"2.5.2","versionType":"custom","status":"affected","changes":[{"at":"2.5.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:11:45.698413Z","id":"CVE-2026-94178","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/import-users-from-csv-with-meta/vulnerability/wordpress-import-and-export-users-and-customers-plugin-2-5-2-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94389","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:26.840","lastModified":"2026-09-30T14:17:49.070","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"AcyMailing Newsletter Team","product":"AcyMailing SMTP Newsletter","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"acymailing","versions":[{"version":"n/a","lessThanOrEqual":"11.0.5","versionType":"custom","status":"affected","changes":[{"at":"11.1.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:11:31.502437Z","id":"CVE-2026-94389","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/acymailing/vulnerability/wordpress-acymailing-smtp-newsletter-plugin-11-0-5-remote-code-execution-rce-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94499","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:27.007","lastModified":"2026-09-30T14:17:49.260","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in FormGent <= 1.12.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"wpWax","product":"FormGent","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"formgent","versions":[{"version":"n/a","lessThanOrEqual":"1.12.2","versionType":"custom","status":"affected","changes":[{"at":"1.12.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:11:36.256546Z","id":"CVE-2026-94499","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/formgent/vulnerability/wordpress-formgent-plugin-1-12-2-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94672","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:27.140","lastModified":"2026-09-30T14:17:49.480","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"10up","product":"Safe SVG","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"safe-svg","versions":[{"version":"n/a","lessThanOrEqual":"2.5.0","versionType":"custom","status":"affected","changes":[{"at":"2.5.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:11:25.342099Z","id":"CVE-2026-94672","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/safe-svg/vulnerability/wordpress-safe-svg-plugin-2-5-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94673","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:27.267","lastModified":"2026-09-30T14:17:49.677","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"NSquared","product":"Simply Schedule Appointments","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"simply-schedule-appointments","versions":[{"version":"n/a","lessThanOrEqual":"1.6.12.31","versionType":"custom","status":"affected","changes":[{"at":"1.6.12.33","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:09:37.497739Z","id":"CVE-2026-94673","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-12-31-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94674","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:27.403","lastModified":"2026-09-30T14:17:49.853","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"SweetCode","product":"Pixel Manager for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woocommerce-google-adwords-conversion-tracking-tag","versions":[{"version":"n/a","lessThanOrEqual":"1.69.0","versionType":"custom","status":"affected","changes":[{"at":"1.69.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:09:31.729797Z","id":"CVE-2026-94674","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woocommerce-google-adwords-conversion-tracking-tag/vulnerability/wordpress-pixel-manager-for-woocommerce-plugin-1-69-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94677","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:27.540","lastModified":"2026-09-30T14:17:50.090","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nexcess","product":"Kadence WooCommerce Email Designer","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"kadence-woocommerce-email-designer","versions":[{"version":"n/a","lessThanOrEqual":"1.5.19.1","versionType":"custom","status":"affected","changes":[{"at":"1.5.19.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:06:35.516919Z","id":"CVE-2026-94677","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/kadence-woocommerce-email-designer/vulnerability/wordpress-kadence-woocommerce-email-designer-plugin-1-5-19-1-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94678","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:27.673","lastModified":"2026-09-30T14:17:50.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Mat Lipe","product":"Go Live Update Urls","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"go-live-update-urls","versions":[{"version":"n/a","lessThanOrEqual":"7.0.8","versionType":"custom","status":"affected","changes":[{"at":"7.1.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:06:24.164363Z","id":"CVE-2026-94678","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/go-live-update-urls/vulnerability/wordpress-go-live-update-urls-plugin-7-0-8-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94681","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:27.810","lastModified":"2026-09-30T14:17:56.583","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Tijmen Smit","product":"WP Store Locator","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-store-locator","versions":[{"version":"n/a","lessThan":"3.0.0","versionType":"custom","status":"affected","changes":[{"at":"3.0.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:06:27.735188Z","id":"CVE-2026-94681","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-store-locator/vulnerability/wordpress-wp-store-locator-plugin-3-0-0-denial-of-service-attack-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94683","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:27.940","lastModified":"2026-09-30T14:18:01.733","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Justin Nealey","product":"DesignSetGo","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"designsetgo","versions":[{"version":"n/a","lessThanOrEqual":"2.8.0","versionType":"custom","status":"affected","changes":[{"at":"2.8.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:06:14.543107Z","id":"CVE-2026-94683","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/designsetgo/vulnerability/wordpress-designsetgo-plugin-2-8-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95531","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:28.587","lastModified":"2026-09-30T14:18:04.457","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"QuantumCloud","product":"Conversational Forms for ChatBot","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"conversational-forms","versions":[{"version":"n/a","lessThanOrEqual":"1.5.0","versionType":"custom","status":"affected","changes":[{"at":"1.5.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:06:09.430448Z","id":"CVE-2026-95531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/conversational-forms/vulnerability/wordpress-conversational-forms-for-chatbot-plugin-1-5-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95587","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:28.720","lastModified":"2026-09-30T14:18:04.593","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Hostinger","product":"Hostinger Migrator","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"1.0","versionType":"custom","status":"affected","changes":[{"at":"1.1.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:06:02.678786Z","id":"CVE-2026-95587","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/migrator-plugin/vulnerability/wordpress-hostinger-migrator-plugin-1-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95616","sourceIdentifier":"security@apache.org","published":"2026-09-30T13:17:28.863","lastModified":"2026-10-06T17:21:33.233","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache WSS4J","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.wss4j:wss4j-ws-security-common","packageURL":"pkg:maven/org.apache.wss4j/wss4j-ws-security-common","versions":[{"version":"4.0.0","lessThan":"4.0.2","versionType":"semver","status":"affected"},{"version":"3.0.0","lessThan":"3.0.6","versionType":"semver","status":"affected"},{"version":"0","lessThan":"2.4.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:43:35.342143Z","id":"CVE-2026-95616","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.4","matchCriteriaId":"A3409718-5467-407D-9B51-14E58B6D2F68"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.6","matchCriteriaId":"31AFF243-7BCE-44BC-85C5-6FE257642C13"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.2","matchCriteriaId":"20E76C98-444D-4DB5-91E0-90E84C196158"}]}]}],"references":[{"url":"https://lists.apache.org/thread.html/sdf0fsphkg4qbj7nh2brjgwvcmd67hct","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/14","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-96338","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:29.037","lastModified":"2026-09-30T14:18:05.980","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Cozmoslabs","product":"Profile Builder","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"profile-builder","versions":[{"version":"n/a","lessThanOrEqual":"4.0.2","versionType":"custom","status":"affected","changes":[{"at":"4.0.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:56.194824Z","id":"CVE-2026-96338","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/profile-builder/vulnerability/wordpress-profile-builder-plugin-4-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96343","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:29.167","lastModified":"2026-09-30T14:18:07.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Custom role PHP Object Injection in WP ERP <= 1.17.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"WP ERP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"erp","versions":[{"version":"n/a","lessThanOrEqual":"1.17.9","versionType":"custom","status":"affected","changes":[{"at":"1.17.10","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:52.836497Z","id":"CVE-2026-96343","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/erp/vulnerability/wordpress-wp-erp-plugin-1-17-9-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96344","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:29.300","lastModified":"2026-09-30T14:18:08.067","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"impleCode","product":"eCommerce Product Catalog","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ecommerce-product-catalog","versions":[{"version":"n/a","lessThanOrEqual":"3.6.0","versionType":"custom","status":"affected","changes":[{"at":"3.6.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:46.912909Z","id":"CVE-2026-96344","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ecommerce-product-catalog/vulnerability/wordpress-ecommerce-product-catalog-plugin-3-6-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96345","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:29.430","lastModified":"2026-09-30T14:18:08.217","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Administrator SQL Injection in Estatik <= 4.3.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Estatik","product":"Estatik","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"estatik","versions":[{"version":"n/a","lessThanOrEqual":"4.3.5","versionType":"custom","status":"affected","changes":[{"at":"4.3.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:40.960530Z","id":"CVE-2026-96345","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/estatik/vulnerability/wordpress-estatik-plugin-4-3-5-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96346","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:29.570","lastModified":"2026-09-30T14:18:08.397","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Author SQL Injection in WP ERP <= 1.17.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"WP ERP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"erp","versions":[{"version":"n/a","lessThanOrEqual":"1.17.9","versionType":"custom","status":"affected","changes":[{"at":"1.17.10","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:09:28.171814Z","id":"CVE-2026-96346","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/erp/vulnerability/wordpress-wp-erp-plugin-1-17-9-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96347","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:29.693","lastModified":"2026-09-30T14:18:08.703","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Bookly","product":"Bookly","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"bookly-responsive-appointment-booking-tool","versions":[{"version":"n/a","lessThanOrEqual":"28.2","versionType":"custom","status":"affected","changes":[{"at":"28.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:09:23.686107Z","id":"CVE-2026-96347","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/bookly-responsive-appointment-booking-tool/vulnerability/wordpress-bookly-plugin-28-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96348","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:29.833","lastModified":"2026-09-30T14:18:09.053","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in Bookly <= 28.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Bookly","product":"Bookly","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"bookly-responsive-appointment-booking-tool","versions":[{"version":"n/a","lessThanOrEqual":"28.2","versionType":"custom","status":"affected","changes":[{"at":"28.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:09:19.018434Z","id":"CVE-2026-96348","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/bookly-responsive-appointment-booking-tool/vulnerability/wordpress-bookly-plugin-28-2-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96349","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:29.967","lastModified":"2026-09-30T14:18:09.253","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"SiteSkite","product":"SiteSkite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"siteskite","versions":[{"version":"n/a","lessThanOrEqual":"2.1.8","versionType":"custom","status":"affected","changes":[{"at":"2.2.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:09:13.015884Z","id":"CVE-2026-96349","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/siteskite/vulnerability/wordpress-siteskite-plugin-2-1-8-remote-code-execution-rce-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96350","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:30.090","lastModified":"2026-09-30T14:18:09.523","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Privilege Escalation in Estatik <= 4.3.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Estatik","product":"Estatik","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"estatik","versions":[{"version":"n/a","lessThanOrEqual":"4.3.5","versionType":"custom","status":"affected","changes":[{"at":"4.3.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:09:02.727998Z","id":"CVE-2026-96350","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/estatik/vulnerability/wordpress-estatik-plugin-4-3-5-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96351","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:30.220","lastModified":"2026-09-30T14:18:09.873","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"RadiusTheme","product":"Classified Listing","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"classified-listing","versions":[{"version":"n/a","lessThanOrEqual":"6.1.3","versionType":"custom","status":"affected","changes":[{"at":"6.1.5","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:37.605708Z","id":"CVE-2026-96351","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-6-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96352","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:30.350","lastModified":"2026-09-30T14:18:10.040","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"YITHEMES","product":"YITH WooCommerce Ajax Search","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"yith-woocommerce-ajax-search","versions":[{"version":"n/a","lessThanOrEqual":"2.28.0","versionType":"custom","status":"affected","changes":[{"at":"2.28.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:32.662749Z","id":"CVE-2026-96352","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/yith-woocommerce-ajax-search/vulnerability/wordpress-yith-woocommerce-ajax-search-plugin-2-28-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96450","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:30.487","lastModified":"2026-09-30T14:18:10.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"pixfort","product":"pixfort Core","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThan":"4.3.3","versionType":"custom","status":"affected","changes":[{"at":"4.3.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:28.277014Z","id":"CVE-2026-96450","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/pixfort-core/vulnerability/wordpress-pixfort-core-plugin-4-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96814","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:30.623","lastModified":"2026-09-30T14:18:10.347","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Titan Labs","product":"WooCommerce Product Table Lite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wc-product-table-lite","versions":[{"version":"n/a","lessThanOrEqual":"5.6.7","versionType":"custom","status":"affected","changes":[{"at":"5.6.9","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:24.664586Z","id":"CVE-2026-96814","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wc-product-table-lite/vulnerability/wordpress-woocommerce-product-table-lite-plugin-5-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96815","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:30.770","lastModified":"2026-09-30T14:18:10.460","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Custom role Privilege Escalation in Vitepos <= 3.5.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"appsbd","product":"Vitepos","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"vitepos-lite","versions":[{"version":"n/a","lessThanOrEqual":"3.5.0","versionType":"custom","status":"affected","changes":[{"at":"3.5.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:21.341369Z","id":"CVE-2026-96815","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/vitepos-lite/vulnerability/wordpress-vitepos-plugin-3-5-0-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96816","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:30.910","lastModified":"2026-09-30T14:18:10.573","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"vendidero","product":"Trusted Shops Easy Integration for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"trusted-shops-easy-integration-for-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"2.0.6","versionType":"custom","status":"affected","changes":[{"at":"2.0.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:15.419886Z","id":"CVE-2026-96816","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/trusted-shops-easy-integration-for-woocommerce/vulnerability/wordpress-trusted-shops-easy-integration-for-woocommerce-plugin-2-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96817","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:31.047","lastModified":"2026-09-30T14:18:10.703","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"MakeCommerce.net","product":"MakeCommerce for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"makecommerce","versions":[{"version":"n/a","lessThanOrEqual":"4.1.0","versionType":"custom","status":"affected","changes":[{"at":"4.1.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:11.647132Z","id":"CVE-2026-96817","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/makecommerce/vulnerability/wordpress-makecommerce-for-woocommerce-plugin-4-1-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96818","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:31.177","lastModified":"2026-09-30T14:18:10.833","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"mra13 / Team Tips and Tricks HQ","product":"WP Express Checkout (Accept PayPal Payments)","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-express-checkout","versions":[{"version":"n/a","lessThanOrEqual":"2.4.9","versionType":"custom","status":"affected","changes":[{"at":"2.5.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:05:06.252855Z","id":"CVE-2026-96818","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-express-checkout/vulnerability/wordpress-wp-express-checkout-accept-paypal-payments-plugin-2-4-9-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96819","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:31.310","lastModified":"2026-09-30T14:18:10.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"bobbingwide","product":"oik","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"oik","versions":[{"version":"n/a","lessThanOrEqual":"4.15.4","versionType":"custom","status":"affected","changes":[{"at":"4.16.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:04:56.220253Z","id":"CVE-2026-96819","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/oik/vulnerability/wordpress-oik-plugin-4-15-4-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96820","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:31.440","lastModified":"2026-09-30T14:18:11.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"awesomesupport","product":"Awesome Support","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"awesome-support","versions":[{"version":"n/a","lessThanOrEqual":"6.3.9","versionType":"custom","status":"affected","changes":[{"at":"6.4.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:04:52.138797Z","id":"CVE-2026-96820","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/awesome-support/vulnerability/wordpress-awesome-support-plugin-6-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96821","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:31.597","lastModified":"2026-09-30T14:18:11.193","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Mahmudul Hasan Arif","product":"FluentBoards","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"fluent-boards","versions":[{"version":"n/a","lessThanOrEqual":"2.0.12","versionType":"custom","status":"affected","changes":[{"at":"2.0.15","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:08:53.401210Z","id":"CVE-2026-96821","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/fluent-boards/vulnerability/wordpress-fluentboards-plugin-2-0-12-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96822","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:31.750","lastModified":"2026-09-30T14:18:11.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Hossni Mubarak","product":"Books Gallery","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-books-gallery","versions":[{"version":"n/a","lessThanOrEqual":"4.8.3","versionType":"custom","status":"affected","changes":[{"at":"4.8.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:08:48.691222Z","id":"CVE-2026-96822","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-books-gallery/vulnerability/wordpress-books-gallery-plugin-4-8-3-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96823","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:31.917","lastModified":"2026-09-30T14:18:11.420","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"CusRev","product":"Customer Reviews for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"customer-reviews-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"5.120.0","versionType":"custom","status":"affected","changes":[{"at":"5.121.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:08:43.011032Z","id":"CVE-2026-96823","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/customer-reviews-woocommerce/vulnerability/wordpress-customer-reviews-for-woocommerce-plugin-5-120-0-arbitrary-content-deletion-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96824","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:32.083","lastModified":"2026-09-30T14:18:11.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"envato","product":"Template Kit – Import","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"template-kit-import","versions":[{"version":"n/a","lessThanOrEqual":"1.0.16","versionType":"custom","status":"affected","changes":[{"at":"1.0.17","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:11:12.782122Z","id":"CVE-2026-96824","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/template-kit-import/vulnerability/wordpress-template-kit-import-plugin-1-0-16-arbitrary-file-deletion-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96825","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:32.220","lastModified":"2026-09-30T14:18:11.663","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"David Anderson / Team Updraft","product":"All In One WP Security & Firewall","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"all-in-one-wp-security-and-firewall","versions":[{"version":"n/a","lessThanOrEqual":"5.4.8","versionType":"custom","status":"affected","changes":[{"at":"5.4.9","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:11:18.066826Z","id":"CVE-2026-96825","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/all-in-one-wp-security-and-firewall/vulnerability/wordpress-all-in-one-wp-security-firewall-plugin-5-4-8-bypass-vulnerability-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96827","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:32.357","lastModified":"2026-09-30T14:18:11.797","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Melapress","product":"Admin Notices Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"admin-notices-manager","versions":[{"version":"n/a","lessThanOrEqual":"1.6.0","versionType":"custom","status":"affected","changes":[{"at":"1.6.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:11:01.142221Z","id":"CVE-2026-96827","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/admin-notices-manager/vulnerability/wordpress-admin-notices-manager-plugin-1-6-0-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96828","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:32.493","lastModified":"2026-09-30T14:18:11.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Vidish","product":"Category Discount Woocommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-product-category-discount","versions":[{"version":"n/a","lessThanOrEqual":"5.18","versionType":"custom","status":"affected","changes":[{"at":"5.19","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:04:46.766848Z","id":"CVE-2026-96828","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-product-category-discount/vulnerability/wordpress-category-discount-woocommerce-plugin-5-18-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96829","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:32.627","lastModified":"2026-09-30T14:18:12.040","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"POSIMYTH","product":"The Plus Addons for Elementor Page Builder Lite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"the-plus-addons-for-elementor-page-builder","versions":[{"version":"n/a","lessThanOrEqual":"6.5.1","versionType":"custom","status":"affected","changes":[{"at":"6.5.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:04:40.297494Z","id":"CVE-2026-96829","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/the-plus-addons-for-elementor-page-builder/vulnerability/wordpress-the-plus-addons-for-elementor-page-builder-lite-plugin-6-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96830","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:32.760","lastModified":"2026-09-30T14:18:12.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nexcess","product":"GiveWP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"give","versions":[{"version":"n/a","lessThanOrEqual":"4.16.9","versionType":"custom","status":"affected","changes":[{"at":"4.17.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:04:36.966848Z","id":"CVE-2026-96830","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-9-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96831","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:32.893","lastModified":"2026-09-30T14:18:12.273","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"themifyme","product":"Themify Builder","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"themify-builder","versions":[{"version":"n/a","lessThanOrEqual":"7.8.1","versionType":"custom","status":"affected","changes":[{"at":"7.8.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:04:33.350224Z","id":"CVE-2026-96831","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/themify-builder/vulnerability/wordpress-themify-builder-plugin-7-8-1-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96832","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:33.023","lastModified":"2026-09-30T14:18:12.383","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"keywordrush","product":"Content Egg","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"content-egg","versions":[{"version":"n/a","lessThanOrEqual":"6.3.1","versionType":"custom","status":"affected","changes":[{"at":"11.9.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:04:28.275670Z","id":"CVE-2026-96832","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/content-egg/vulnerability/wordpress-content-egg-plugin-6-3-1-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96833","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:33.153","lastModified":"2026-09-30T14:18:12.500","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Themefic","product":"Ultimate Addons for Contact Form 7","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ultimate-addons-for-contact-form-7","versions":[{"version":"n/a","lessThanOrEqual":"3.5.51","versionType":"custom","status":"affected","changes":[{"at":"3.5.52","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:04:21.095936Z","id":"CVE-2026-96833","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-contact-form-7/vulnerability/wordpress-ultimate-addons-for-contact-form-7-plugin-3-5-51-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96834","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:33.280","lastModified":"2026-09-30T14:18:12.610","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nexcess","product":"GiveWP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"give","versions":[{"version":"n/a","lessThanOrEqual":"4.16.9","versionType":"custom","status":"affected","changes":[{"at":"4.17.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:04:07.496300Z","id":"CVE-2026-96834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-9-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96835","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:33.410","lastModified":"2026-09-30T14:18:12.730","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"KingAddons.com","product":"King Addons for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"king-addons","versions":[{"version":"n/a","lessThanOrEqual":"51.1.85","versionType":"custom","status":"affected","changes":[{"at":"51.1.86","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:04:11.512143Z","id":"CVE-2026-96835","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/king-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-51-1-85-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96836","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:33.537","lastModified":"2026-09-30T14:18:12.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Morteza Geransayeh","product":"Parsi Date","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-parsidate","versions":[{"version":"n/a","lessThanOrEqual":"6.3","versionType":"custom","status":"affected","changes":[{"at":"6.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:04:01.223245Z","id":"CVE-2026-96836","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-parsidate/vulnerability/wordpress-parsi-date-plugin-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96837","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:33.673","lastModified":"2026-09-30T14:18:12.963","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Brainstorm Force","product":"CartFlows","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"cartflows","versions":[{"version":"n/a","lessThanOrEqual":"3.2.0","versionType":"custom","status":"affected","changes":[{"at":"3.2.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:03:57.727964Z","id":"CVE-2026-96837","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-98"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/cartflows/vulnerability/wordpress-cartflows-plugin-3-2-0-remote-code-execution-rce-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96838","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:33.810","lastModified":"2026-09-30T14:18:13.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification <= 2.3.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"YoOhw Studio","product":"Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wc-blacklist-manager","versions":[{"version":"n/a","lessThanOrEqual":"2.3.1","versionType":"custom","status":"affected","changes":[{"at":"2.3.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:10:57.103287Z","id":"CVE-2026-96838","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wc-blacklist-manager/vulnerability/wordpress-blacklist-manager-8211-woocommerce-anti-fraud-blacklist-amp-checkout-verification-plugin-2-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97065","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:33.950","lastModified":"2026-09-30T14:18:13.347","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Happyforms","product":"Happyforms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"happyforms","versions":[{"version":"n/a","lessThanOrEqual":"1.26.15","versionType":"custom","status":"affected","changes":[{"at":"1.26.16","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:10:53.414361Z","id":"CVE-2026-97065","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/happyforms/vulnerability/wordpress-happyforms-plugin-1-26-15-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97066","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:34.080","lastModified":"2026-09-30T14:18:13.467","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nexcess","product":"GiveWP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"give","versions":[{"version":"n/a","lessThanOrEqual":"4.16.9","versionType":"custom","status":"affected","changes":[{"at":"4.17.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:10:48.605501Z","id":"CVE-2026-97066","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97067","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:34.207","lastModified":"2026-09-30T14:18:13.577","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Shane Bishop","product":"EWWW Image Optimizer","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ewww-image-optimizer","versions":[{"version":"n/a","lessThanOrEqual":"8.7.7","versionType":"custom","status":"affected","changes":[{"at":"8.8.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:08:37.646362Z","id":"CVE-2026-97067","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ewww-image-optimizer/vulnerability/wordpress-ewww-image-optimizer-plugin-8-7-7-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97074","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:34.340","lastModified":"2026-09-30T14:18:13.693","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Omnisend","product":"Newsletters, Email Marketing, SMS and Popups by Omnisend","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"omnisend","versions":[{"version":"n/a","lessThanOrEqual":"1.9.0","versionType":"custom","status":"affected","changes":[{"at":"1.9.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:08:34.086349Z","id":"CVE-2026-97074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/omnisend/vulnerability/wordpress-newsletters-email-marketing-sms-and-popups-by-omnisend-plugin-1-9-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97077","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:34.470","lastModified":"2026-09-30T14:18:13.803","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Spacetime","product":"Ad Inserter","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ad-inserter","versions":[{"version":"n/a","lessThanOrEqual":"2.8.18","versionType":"custom","status":"affected","changes":[{"at":"2.8.19","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:08:29.859436Z","id":"CVE-2026-97077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ad-inserter/vulnerability/wordpress-ad-inserter-plugin-2-8-18-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97078","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:34.600","lastModified":"2026-09-30T14:18:13.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"BoldGrid","product":"Client Invoicing by Sprout Invoices","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"sprout-invoices","versions":[{"version":"n/a","lessThanOrEqual":"20.8.17","versionType":"custom","status":"affected","changes":[{"at":"20.8.18","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:08:26.378418Z","id":"CVE-2026-97078","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sprout-invoices/vulnerability/wordpress-client-invoicing-by-sprout-invoices-plugin-20-8-17-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97079","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:34.730","lastModified":"2026-09-30T14:18:14.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Webba Appointment Booking","product":"Webba Booking","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"webba-booking-lite","versions":[{"version":"n/a","lessThanOrEqual":"6.5.0","versionType":"custom","status":"affected","changes":[{"at":"6.5.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:03:51.901950Z","id":"CVE-2026-97079","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-6-5-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97197","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:34.877","lastModified":"2026-09-30T14:18:14.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WebToffee","product":"WordPress Backup & Migration","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-migration-duplicator","versions":[{"version":"n/a","lessThanOrEqual":"1.6.0","versionType":"custom","status":"affected","changes":[{"at":"1.6.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:03:42.588076Z","id":"CVE-2026-97197","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-migration-duplicator/vulnerability/wordpress-wordpress-backup-migration-plugin-1-6-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97235","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:35.083","lastModified":"2026-09-30T14:18:14.393","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeRex","product":"ThemeREX Addons","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThan":"2.45.0","versionType":"custom","status":"affected","changes":[{"at":"2.45.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:03:34.325937Z","id":"CVE-2026-97235","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/trx_addons/vulnerability/wordpress-themerex-addons-plugin-2-45-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97236","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:35.227","lastModified":"2026-09-30T14:18:14.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeRex","product":"ThemeREX Addons","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThan":"2.45.0","versionType":"custom","status":"affected","changes":[{"at":"2.45.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:03:30.956832Z","id":"CVE-2026-97236","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/trx_addons/vulnerability/wordpress-themerex-addons-plugin-2-45-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97237","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:35.357","lastModified":"2026-10-22T17:17:01.887","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Crocoblock","product":"JetEngine","defaultStatus":"unaffected","collectionURL":"https://crocoblock.com","packageName":"jet-engine","versions":[{"version":"0","lessThanOrEqual":"3.8.14.3","versionType":"custom","status":"affected","changes":[{"at":"3.8.15","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:03:27.932950Z","id":"CVE-2026-97237","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-14-3-cross-site-scripting-xss-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97238","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:35.483","lastModified":"2026-09-30T14:18:14.737","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"3.8.14.3","versionType":"custom","status":"affected","changes":[{"at":"3.8.15","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:03:24.734653Z","id":"CVE-2026-97238","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-14-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97239","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:35.617","lastModified":"2026-09-30T14:18:14.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Jose Conti","product":"MCP Content Manager Lite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"mcp-content-manager-lite","versions":[{"version":"n/a","lessThanOrEqual":"1.1.0","versionType":"custom","status":"affected","changes":[{"at":"1.2.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:03:21.772728Z","id":"CVE-2026-97239","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mcp-content-manager-lite/vulnerability/wordpress-mcp-content-manager-lite-plugin-1-1-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97240","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:35.747","lastModified":"2026-09-30T14:18:14.953","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Esteban","product":"StifLi Backup Tools","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"stifli-backup-tools","versions":[{"version":"n/a","lessThanOrEqual":"2.2.7","versionType":"custom","status":"affected","changes":[{"at":"2.2.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:03:11.314321Z","id":"CVE-2026-97240","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/stifli-backup-tools/vulnerability/wordpress-stifli-backup-tools-plugin-2-2-7-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97241","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:35.887","lastModified":"2026-09-30T14:18:15.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"PrecisionWP","product":"BackupEase","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"backupease","versions":[{"version":"n/a","lessThanOrEqual":"2.2.2","versionType":"custom","status":"affected","changes":[{"at":"2.2.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:03:16.403207Z","id":"CVE-2026-97241","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/backupease/vulnerability/wordpress-backupease-plugin-2-2-2-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97242","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:36.030","lastModified":"2026-09-30T14:18:15.190","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"phuongwebo","product":"WEBO MCP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"webo-mcp","versions":[{"version":"n/a","lessThanOrEqual":"3.0.18","versionType":"custom","status":"affected","changes":[{"at":"3.0.22","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:03:02.031751Z","id":"CVE-2026-97242","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/webo-mcp/vulnerability/wordpress-webo-mcp-plugin-3-0-18-arbitrary-file-deletion-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97243","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:36.167","lastModified":"2026-09-30T14:18:15.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"flexyma","product":"AllAble Connector","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"allable-connector","versions":[{"version":"n/a","lessThanOrEqual":"0.13.4","versionType":"custom","status":"affected","changes":[{"at":"0.13.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:08:19.610394Z","id":"CVE-2026-97243","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/allable-connector/vulnerability/wordpress-allable-connector-plugin-0-13-4-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97244","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:36.300","lastModified":"2026-09-30T14:18:15.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Path Traversal in Creator LMS <= 1.2.19 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPFunnels","product":"Creator LMS","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"creatorlms","versions":[{"version":"n/a","lessThanOrEqual":"1.2.19","versionType":"custom","status":"affected","changes":[{"at":"1.2.20","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:08:14.833008Z","id":"CVE-2026-97244","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-35"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/creatorlms/vulnerability/wordpress-creator-lms-plugin-1-2-19-path-traversal-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97245","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:36.433","lastModified":"2026-09-30T14:18:15.550","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"SureCart","product":"SureCart","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"surecart","versions":[{"version":"n/a","lessThanOrEqual":"4.7.2","versionType":"custom","status":"affected","changes":[{"at":"4.7.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:08:09.066395Z","id":"CVE-2026-97245","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/surecart/vulnerability/wordpress-surecart-plugin-4-7-2-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97246","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:36.563","lastModified":"2026-10-20T14:17:04.963","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ShortPixel","product":"ShortPixel Image Optimizer","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"shortpixel-image-optimiser","versions":[{"version":"0","lessThanOrEqual":"6.5.5","versionType":"custom","status":"affected","changes":[{"at":"6.5.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:07:56.292083Z","id":"CVE-2026-97246","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/shortpixel-image-optimiser/vulnerability/wordpress-shortpixel-image-optimizer-plugin-6-5-5-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97247","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:36.697","lastModified":"2026-09-30T14:18:15.780","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Creative Themes","product":"Blocksy Companion","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"blocksy-companion","versions":[{"version":"n/a","lessThanOrEqual":"2.1.55","versionType":"custom","status":"affected","changes":[{"at":"2.1.56","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:01:45.920454Z","id":"CVE-2026-97247","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/blocksy-companion/vulnerability/wordpress-blocksy-companion-plugin-2-1-55-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97248","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:36.830","lastModified":"2026-09-30T14:18:15.890","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Booking Activities Team","product":"Booking Activities","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"booking-activities","versions":[{"version":"n/a","lessThanOrEqual":"1.18.7.1","versionType":"custom","status":"affected","changes":[{"at":"1.18.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:01:39.358788Z","id":"CVE-2026-97248","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/booking-activities/vulnerability/wordpress-booking-activities-plugin-1-18-7-1-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97249","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:36.960","lastModified":"2026-09-30T14:18:16.013","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Cozmoslabs","product":"Paid Member Subscriptions","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"paid-member-subscriptions","versions":[{"version":"n/a","lessThanOrEqual":"3.0.9","versionType":"custom","status":"affected","changes":[{"at":"3.1.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:01:32.670456Z","id":"CVE-2026-97249","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-plugin-3-0-9-bypass-vulnerability-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97250","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:37.110","lastModified":"2026-09-30T14:18:16.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in  Geo Mashup <= 1.13.21 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Dylan Kuhn","product":"Geo Mashup","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"geo-mashup","versions":[{"version":"n/a","lessThanOrEqual":"1.13.21","versionType":"custom","status":"affected","changes":[{"at":"1.13.22","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:01:20.463066Z","id":"CVE-2026-97250","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-21-cross-site-scripting-xss-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97253","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:37.257","lastModified":"2026-09-30T14:18:16.250","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS.\n\nThis issue affects LayerSlider: from n/a through 8.4.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Kreatura","product":"LayerSlider","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"8.4.0","versionType":"custom","status":"affected","changes":[{"at":"8.4.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:08:02.982462Z","id":"CVE-2026-97253","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/layerslider/vulnerability/wordpress-layerslider-plugin-8-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97261","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:37.400","lastModified":"2026-09-30T14:18:16.367","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"VillaTheme","product":"Notivo","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-notification","versions":[{"version":"n/a","lessThanOrEqual":"1.4.2","versionType":"custom","status":"affected","changes":[{"at":"1.4.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:07:49.258451Z","id":"CVE-2026-97261","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-notification/vulnerability/wordpress-notivo-plugin-1-4-2-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97262","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:37.530","lastModified":"2026-09-30T14:18:16.490","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Visual Composer","product":"Visual Composer Website Builder","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"visualcomposer","versions":[{"version":"n/a","lessThanOrEqual":"45.16.2","versionType":"custom","status":"affected","changes":[{"at":"45.16.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:02:57.338591Z","id":"CVE-2026-97262","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/visualcomposer/vulnerability/wordpress-visual-composer-website-builder-plugin-45-16-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97266","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:37.660","lastModified":"2026-09-30T14:18:16.603","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nexcess","product":"Virtue/Ascend/Pinnacle Toolkit","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"virtue-toolkit","versions":[{"version":"n/a","lessThanOrEqual":"4.9.12.1","versionType":"custom","status":"affected","changes":[{"at":"4.9.12.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:02:53.943190Z","id":"CVE-2026-97266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/virtue-toolkit/vulnerability/wordpress-virtue-ascend-pinnacle-toolkit-plugin-4-9-12-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97267","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:37.787","lastModified":"2026-09-30T14:18:16.717","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"miniOrange","product":"Prevent files / folders access","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"prevent-file-access","versions":[{"version":"n/a","lessThanOrEqual":"2.6.7","versionType":"custom","status":"affected","changes":[{"at":"2.6.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:02:49.793355Z","id":"CVE-2026-97267","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/prevent-file-access/vulnerability/wordpress-prevent-files-folders-access-plugin-2-6-7-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97270","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:37.913","lastModified":"2026-09-30T14:18:16.837","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Justin Sternberg","product":"CMB2","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"cmb2","versions":[{"version":"n/a","lessThanOrEqual":"2.13.0","versionType":"custom","status":"affected","changes":[{"at":"2.13.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:02:45.457907Z","id":"CVE-2026-97270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/cmb2/vulnerability/wordpress-cmb2-plugin-2-13-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97271","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:38.040","lastModified":"2026-09-30T14:18:16.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPFunnels","product":"WPFunnels","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpfunnels","versions":[{"version":"n/a","lessThanOrEqual":"3.13.1","versionType":"custom","status":"affected","changes":[{"at":"3.13.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:59:05.798360Z","id":"CVE-2026-97271","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpfunnels/vulnerability/wordpress-wpfunnels-plugin-3-13-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97272","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:38.167","lastModified":"2026-09-30T14:18:17.060","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Premmerce","product":"Premmerce Permalink Manager for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-permalink-manager","versions":[{"version":"n/a","lessThanOrEqual":"2.3.13","versionType":"custom","status":"affected","changes":[{"at":"2.3.16","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:58:57.902258Z","id":"CVE-2026-97272","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-permalink-manager/vulnerability/wordpress-premmerce-permalink-manager-for-woocommerce-plugin-2-3-13-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97274","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:38.293","lastModified":"2026-09-30T14:18:17.173","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"miniOrange","product":"OAuth Single Sign On – SSO (OAuth Client)","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"miniorange-login-with-eve-online-google-facebook","versions":[{"version":"n/a","lessThanOrEqual":"7.1.2","versionType":"custom","status":"affected","changes":[{"at":"7.1.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:58:48.916090Z","id":"CVE-2026-97274","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/miniorange-login-with-eve-online-google-facebook/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-7-1-2-bypass-vulnerability-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97279","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:38.417","lastModified":"2026-09-30T14:18:17.290","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Chouby","product":"Polylang","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"polylang","versions":[{"version":"n/a","lessThanOrEqual":"3.8.9","versionType":"custom","status":"affected","changes":[{"at":"3.8.10","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:58:39.456793Z","id":"CVE-2026-97279","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/polylang/vulnerability/wordpress-polylang-plugin-3-8-9-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97282","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:38.550","lastModified":"2026-09-30T14:18:17.433","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"RadiusTheme","product":"Review Schema","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"review-schema","versions":[{"version":"n/a","lessThanOrEqual":"3.1.0","versionType":"custom","status":"affected","changes":[{"at":"3.1.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:58:32.321087Z","id":"CVE-2026-97282","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/review-schema/vulnerability/wordpress-review-schema-plugin-3-1-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97285","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:38.680","lastModified":"2026-09-30T14:18:17.567","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nexcess","product":"The Events Calendar","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"the-events-calendar","versions":[{"version":"n/a","lessThanOrEqual":"6.17.5","versionType":"custom","status":"affected","changes":[{"at":"6.17.5.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:58:23.956013Z","id":"CVE-2026-97285","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-17-5-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97286","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:38.813","lastModified":"2026-10-02T18:17:09.443","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Chill","product":"Strong Testimonials","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"strong-testimonials","versions":[{"version":"0","lessThanOrEqual":"3.3.11","versionType":"custom","status":"affected","changes":[{"at":"3.3.12","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:58:15.876322Z","id":"CVE-2026-97286","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/strong-testimonials/vulnerability/wordpress-strong-testimonials-plugin-3-3-11-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97287","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:38.943","lastModified":"2026-10-15T00:17:00.003","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection.\n\nThis issue affects Event Tickets: from n/a through 5.29.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Liquid Web / StellarWP","product":"Event Tickets","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"event-tickets","versions":[{"version":"0","lessThanOrEqual":"5.29.5","versionType":"custom","status":"affected","changes":[{"at":"5.29.5.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:58:05.666158Z","id":"CVE-2026-97287","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://intrudify.com/research/advisories/cve-2026-97287/","source":"audit@patchstack.com"},{"url":"https://patchstack.com/database/wordpress/plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-29-5-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97288","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:39.077","lastModified":"2026-09-30T14:18:17.913","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Jayson T Cote","product":"OAuth Server","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"oauth2-provider","versions":[{"version":"n/a","lessThanOrEqual":"4.5.1","versionType":"custom","status":"affected","changes":[{"at":"4.5.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:57:57.426802Z","id":"CVE-2026-97288","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/oauth2-provider/vulnerability/wordpress-oauth-server-plugin-4-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97289","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:39.210","lastModified":"2026-10-09T18:17:16.717","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ExpressTech","product":"Quiz And Survey Master","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"quiz-master-next","versions":[{"version":"0","lessThanOrEqual":"11.2.6","versionType":"custom","status":"affected","changes":[{"at":"11.2.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T12:57:48.473627Z","id":"CVE-2026-97289","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97292","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:39.357","lastModified":"2026-09-30T14:18:18.140","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"YITHEMES","product":"YITH WooCommerce Tab Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"yith-woocommerce-tab-manager","versions":[{"version":"n/a","lessThanOrEqual":"2.15.0","versionType":"custom","status":"affected","changes":[{"at":"2.15.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:02:40.046826Z","id":"CVE-2026-97292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/yith-woocommerce-tab-manager/vulnerability/wordpress-yith-woocommerce-tab-manager-plugin-2-15-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97293","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:39.490","lastModified":"2026-09-30T14:18:18.460","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"David Lingren","product":"Media LIbrary Assistant","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"media-library-assistant","versions":[{"version":"n/a","lessThanOrEqual":"3.41","versionType":"custom","status":"affected","changes":[{"at":"3.42","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:02:36.657094Z","id":"CVE-2026-97293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-41-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97298","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:39.623","lastModified":"2026-09-30T14:18:18.587","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"KingAddons","product":"King Addons for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"king-addons","versions":[{"version":"n/a","lessThanOrEqual":"51.1.86","versionType":"custom","status":"affected","changes":[{"at":"51.1.87","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:02:32.245646Z","id":"CVE-2026-97298","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/king-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-51-1-86-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97299","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:39.757","lastModified":"2026-09-30T14:18:18.703","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"KnitPay","product":"Razorpay Payment Links for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"rzp-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"2.1.5","versionType":"custom","status":"affected","changes":[{"at":"2.2.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:02:28.886991Z","id":"CVE-2026-97299","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/rzp-woocommerce/vulnerability/wordpress-razorpay-payment-links-for-woocommerce-plugin-2-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97301","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:39.897","lastModified":"2026-10-23T22:10:00.160","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions."},{"lang":"es","value":"Cross-Site Scripting (XSS) de Colaborador en las versiones de Cool Formkit Lite menor o igual a 2.7.8."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Cool Plugins","product":"Cool Formkit Lite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"extensions-for-elementor-form","versions":[{"version":"n/a","lessThanOrEqual":"2.7.8","versionType":"custom","status":"affected","changes":[{"at":"2.7.9","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:02:24.694319Z","id":"CVE-2026-97301","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/extensions-for-elementor-form/vulnerability/wordpress-cool-formkit-lite-plugin-2-7-8-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97302","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T13:17:40.033","lastModified":"2026-10-12T15:10:00.207","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions."},{"lang":"es","value":"Exposición de datos sensibles no autenticada en versiones de MPG menor o igual que 4.2.3."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Themeisle","product":"MPG","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"multiple-pages-generator-by-porthas","versions":[{"version":"n/a","lessThanOrEqual":"4.2.3","versionType":"custom","status":"affected","changes":[{"at":"4.2.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T13:02:19.770249Z","id":"CVE-2026-97302","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/multiple-pages-generator-by-porthas/vulnerability/wordpress-mpg-plugin-4-2-3-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103118","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T14:17:27.347","lastModified":"2026-10-02T17:17:01.630","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"GraphicsMagick","cpes":["cpe:2.3:a:graphicsmagick:graphicsmagick:*:*:*:*:*:*:*:*"],"modules":["WPG File Handler"],"versions":[{"version":"1.3.0","status":"affected"},{"version":"1.3.1","status":"affected"},{"version":"1.3.2","status":"affected"},{"version":"1.3.3","status":"affected"},{"version":"1.3.4","status":"affected"},{"version":"1.3.5","status":"affected"},{"version":"1.3.6","status":"affected"},{"version":"1.3.7","status":"affected"},{"version":"1.3.8","status":"affected"},{"version":"1.3.9","status":"affected"},{"version":"1.3.10","status":"affected"},{"version":"1.3.11","status":"affected"},{"version":"1.3.12","status":"affected"},{"version":"1.3.13","status":"affected"},{"version":"1.3.14","status":"affected"},{"version":"1.3.15","status":"affected"},{"version":"1.3.16","status":"affected"},{"version":"1.3.17","status":"affected"},{"version":"1.3.18","status":"affected"},{"version":"1.3.19","status":"affected"},{"version":"1.3.20","status":"affected"},{"version":"1.3.21","status":"affected"},{"version":"1.3.22","status":"affected"},{"version":"1.3.23","status":"affected"},{"version":"1.3.24","status":"affected"},{"version":"1.3.25","status":"affected"},{"version":"1.3.26","status":"affected"},{"version":"1.3.27","status":"affected"},{"version":"1.3.28","status":"affected"},{"version":"1.3.29","status":"affected"},{"version":"1.3.30","status":"affected"},{"version":"1.3.31","status":"affected"},{"version":"1.3.32","status":"affected"},{"version":"1.3.33","status":"affected"},{"version":"1.3.34","status":"affected"},{"version":"1.3.35","status":"affected"},{"version":"1.3.36","status":"affected"},{"version":"1.3.37","status":"affected"},{"version":"1.3.38","status":"affected"},{"version":"1.3.39","status":"affected"},{"version":"1.3.40","status":"affected"},{"version":"1.3.41","status":"affected"},{"version":"1.3.42","status":"affected"},{"version":"1.3.43","status":"affected"},{"version":"1.3.44","status":"affected"},{"version":"1.3.45","status":"affected"},{"version":"1.3.46","status":"affected"},{"version":"1.3.47","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:13:06.398536Z","id":"CVE-2026-103118","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-404"},{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/627b5b1b2fc2","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103118","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/954970","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411874","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411874/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-82307","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-30T14:17:31.257","lastModified":"2026-09-30T16:18:57.403","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection.\n\nThis issue affects SOPLOG: before Soplog 2026.9.4.1."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"Dolusoft Software Technologies","product":"SOPLOG","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Soplog 2026.9.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:25:11.142931Z","id":"CVE-2026-82307","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1224","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-91860","sourceIdentifier":"security@vaadin.com","published":"2026-09-30T14:17:34.133","lastModified":"2026-09-30T16:38:20.847","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 23.0.0 - 23.6.13\nVaadin 24.0.0 - 24.9.20\nVaadin 24.10.0 - 24.10.9\nVaadin 25.0.0 - 25.1.11\nVaadin 25.2.0 - 25.2.6\n\nMitigation\nUpgrade to 23.6.14\nUpgrade to 24.9.21\nUpgrade to 24.10.10\nUpgrade to 25.1.12\nUpgrade to 25.2.7 or newer\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates Vulnerable versions Fixed version\ncom.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21\ncom.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21\ncom.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21\ncom.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 >=25.2.7\n\nnpm packages\nnpm package Vulnerable versions Fixed version\n@vaadin/charts 23.0.0 - 23.6.4 >=23.6.5\n@vaadin/charts 24.0.0 - 24.9.17 >=24.9.18\n@vaadin/charts 24.10.0 - 24.10.4 >=24.10.5\n@vaadin/charts 25.0.0 - 25.1.11 >=25.1.12\n@vaadin/charts 25.2.0 - 25.2.8 >=25.2.9\n@vaadin/component-base 24.7.0 - 24.9.17 >=24.9.18\n@vaadin/component-base 24.10.0 - 24.10.4 >=24.10.5\n@vaadin/component-base 25.0.0 - 25.1.11 >=25.1.12\n@vaadin/component-base 25.2.0 - 25.2.8 >=25.2.9"}],"affected":[{"source":"security@vaadin.com","affectedData":[{"vendor":"vaadin","product":"vaadin","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"com.vaadin:vaadin","repo":"https://github.com/vaadin/platform","versions":[{"version":"23.0.0","lessThan":"23.6.14","versionType":"maven","status":"affected"},{"version":"24.0.0","lessThan":"24.9.21","versionType":"maven","status":"affected"},{"version":"24.10.0","lessThan":"24.10.10","versionType":"maven","status":"affected"},{"version":"25.0.0","lessThan":"25.1.12","versionType":"maven","status":"affected"},{"version":"25.2.0","lessThan":"25.2.7","versionType":"maven","status":"affected"}]},{"vendor":"vaadin","product":"vaadin-core","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"com.vaadin:vaadin-core","repo":"https://github.com/vaadin/platform","versions":[{"version":"24.7.0","lessThan":"24.9.21","versionType":"maven","status":"affected"},{"version":"24.10.0","lessThan":"24.10.10","versionType":"maven","status":"affected"},{"version":"25.0.0","lessThan":"25.1.12","versionType":"maven","status":"affected"},{"version":"25.2.0","lessThan":"25.2.7","versionType":"maven","status":"affected"}]},{"vendor":"vaadin","product":"vaadin-charts-flow","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"com.vaadin:vaadin-charts-flow","repo":"https://github.com/vaadin/flow-components","versions":[{"version":"23.0.0","lessThan":"23.6.14","versionType":"maven","status":"affected"},{"version":"24.0.0","lessThan":"24.9.21","versionType":"maven","status":"affected"},{"version":"24.10.0","lessThan":"24.10.10","versionType":"maven","status":"affected"},{"version":"25.0.0","lessThan":"25.1.12","versionType":"maven","status":"affected"},{"version":"25.2.0","lessThan":"25.2.7","versionType":"maven","status":"affected"}]},{"vendor":"vaadin","product":"@vaadin/charts","defaultStatus":"unaffected","collectionURL":"https://registry.npmjs.org","packageName":"@vaadin/charts","repo":"https://github.com/vaadin/web-components","versions":[{"version":"23.0.0","lessThan":"23.6.5","versionType":"semver","status":"affected"},{"version":"24.0.0","lessThan":"24.9.18","versionType":"semver","status":"affected"},{"version":"24.10.0","lessThan":"24.10.5","versionType":"semver","status":"affected"},{"version":"25.0.0","lessThan":"25.1.12","versionType":"semver","status":"affected"},{"version":"25.2.0","lessThan":"25.2.9","versionType":"semver","status":"affected"}]},{"vendor":"vaadin","product":"@vaadin/component-base","defaultStatus":"unaffected","collectionURL":"https://registry.npmjs.org","packageName":"@vaadin/component-base","repo":"https://github.com/vaadin/web-components","versions":[{"version":"24.7.0","lessThan":"24.9.18","versionType":"semver","status":"affected"},{"version":"24.10.0","lessThan":"24.10.5","versionType":"semver","status":"affected"},{"version":"25.0.0","lessThan":"25.1.12","versionType":"semver","status":"affected"},{"version":"25.2.0","lessThan":"25.2.9","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@vaadin.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:26:16.234947Z","id":"CVE-2026-91860","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@vaadin.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/vaadin/web-components/pull/12483","source":"security@vaadin.com"},{"url":"https://github.com/vaadin/web-components/pull/12492","source":"security@vaadin.com"},{"url":"https://github.com/vaadin/web-components/pull/12493","source":"security@vaadin.com"},{"url":"https://github.com/vaadin/web-components/pull/12494","source":"security@vaadin.com"},{"url":"https://github.com/vaadin/web-components/pull/12496","source":"security@vaadin.com"},{"url":"https://github.com/vaadin/web-components/pull/12559","source":"security@vaadin.com"},{"url":"https://vaadin.com/security/cve-2026-91860","source":"security@vaadin.com"}]}},{"cve":{"id":"CVE-2026-93547","sourceIdentifier":"security@vaadin.com","published":"2026-09-30T14:17:34.997","lastModified":"2026-09-30T16:38:20.847","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 23.1.0 - 23.6.13\nVaadin 24.0.0 - 24.9.21\nVaadin 24.10.0 - 24.10.9\nVaadin 25.0.0 - 25.1.11\nVaadin 25.2.0 - 25.2.6\nVaadin Framework 7 and 8 with the Spreadsheet add-on 2.0.0 - 3.1.0\n\nMitigation\nUpgrade to 23.6.14\nUpgrade to 24.9.22\nUpgrade to 24.10.10\nUpgrade to 25.1.12\nUpgrade to 25.2.7 or newer\nUpgrade the Spreadsheet add-on to 3.1.1\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates Vulnerable versions Fixed version\ncom.vaadin:vaadin 23.1.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin 24.0.0 - 24.9.21 >=24.9.22\ncom.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-spreadsheet-flow 23.1.0 - 23.6.13 >=23.6.14\ncom.vaadin:vaadin-spreadsheet-flow 24.0.0 - 24.9.21 >=24.9.22\ncom.vaadin:vaadin-spreadsheet-flow 24.10.0 - 24.10.9 >=24.10.10\ncom.vaadin:vaadin-spreadsheet-flow 25.0.0 - 25.1.11 >=25.1.12\ncom.vaadin:vaadin-spreadsheet-flow 25.2.0 - 25.2.6 >=25.2.7\ncom.vaadin:vaadin-spreadsheet 2.0.0 - 3.1.0 >=3.1.1"}],"affected":[{"source":"security@vaadin.com","affectedData":[{"vendor":"vaadin","product":"vaadin","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"com.vaadin:vaadin","repo":"https://github.com/vaadin/platform","versions":[{"version":"23.1.0","lessThan":"23.6.14","versionType":"maven","status":"affected"},{"version":"24.0.0","lessThan":"24.9.22","versionType":"maven","status":"affected"},{"version":"24.10.0","lessThan":"24.10.10","versionType":"maven","status":"affected"},{"version":"25.0.0","lessThan":"25.1.12","versionType":"maven","status":"affected"},{"version":"25.2.0","lessThan":"25.2.7","versionType":"maven","status":"affected"}]},{"vendor":"vaadin","product":"vaadin-spreadsheet-flow","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"com.vaadin:vaadin-spreadsheet-flow","repo":"https://github.com/vaadin/flow-components","versions":[{"version":"23.1.0","lessThan":"23.6.14","versionType":"maven","status":"affected"},{"version":"24.0.0","lessThan":"24.9.22","versionType":"maven","status":"affected"},{"version":"24.10.0","lessThan":"24.10.10","versionType":"maven","status":"affected"},{"version":"25.0.0","lessThan":"25.1.12","versionType":"maven","status":"affected"},{"version":"25.2.0","lessThan":"25.2.7","versionType":"maven","status":"affected"}]},{"vendor":"vaadin","product":"vaadin-spreadsheet","defaultStatus":"unaffected","collectionURL":"https://maven.vaadin.com/vaadin-addons","packageName":"com.vaadin:vaadin-spreadsheet","repo":"https://github.com/vaadin/spreadsheet","versions":[{"version":"2.0.0","lessThan":"3.1.1","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@vaadin.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:25:51.477902Z","id":"CVE-2026-93547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@vaadin.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/vaadin/flow-components/pull/9905","source":"security@vaadin.com"},{"url":"https://github.com/vaadin/flow-components/pull/9907","source":"security@vaadin.com"},{"url":"https://github.com/vaadin/flow-components/pull/9908","source":"security@vaadin.com"},{"url":"https://github.com/vaadin/flow-components/pull/9909","source":"security@vaadin.com"},{"url":"https://github.com/vaadin/flow-components/pull/9910","source":"security@vaadin.com"},{"url":"https://github.com/vaadin/flow-components/pull/9956","source":"security@vaadin.com"},{"url":"https://github.com/vaadin/spreadsheet/pull/866","source":"security@vaadin.com"},{"url":"https://vaadin.com/security/cve-2026-93547","source":"security@vaadin.com"}]}},{"cve":{"id":"CVE-2026-93903","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T14:17:37.060","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain \"corner case.\""}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"litespeedtech","product":"LiteSpeed Web Server","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.3.7 build 1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:30:20.403820Z","id":"CVE-2026-93903","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-174"}]}],"references":[{"url":"https://docs.litespeedtech.com/lsws/changelog/#v6-3-7-build-1","source":"cve@mitre.org"},{"url":"https://www.litespeedtech.com/products/litespeed-web-server/release-log","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-101295","sourceIdentifier":"secalert@redhat.com","published":"2026-09-30T15:22:19.423","lastModified":"2026-09-30T21:16:55.080","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Assisted Installer for Red Hat OpenShift Container Platform 2","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"assisted/agent-preinstall-image-builder-rhel9","cpes":["cpe:/a:redhat:assisted_installer:2"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/oc-mirror-plugin-rhel8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/oc-mirror-plugin-rhel9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:43:00.483333Z","id":"CVE-2026-101295","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-101295","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522941","source":"secalert@redhat.com"},{"url":"https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/catalog_images.go#L680","source":"secalert@redhat.com"},{"url":"https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/fbc_operators.go#L334-L369","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-102717","sourceIdentifier":"emo@eclipse.org","published":"2026-09-30T15:22:21.957","lastModified":"2026-09-30T20:17:22.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash"}],"affected":[{"source":"emo@eclipse.org","affectedData":[{"vendor":"Eclipse Foundation","product":"NetX Duo","defaultStatus":"unaffected","packageName":"NetX Duo","versions":[{"version":"6.4.4","lessThanOrEqual":"6.5.1.202602","versionType":"semver","status":"affected"},{"version":"6.5.2.202603","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:59:31.272344Z","id":"CVE-2026-102717","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"emo@eclipse.org","type":"Secondary","description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-457"}]}],"references":[{"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-hp64-f44f-wjw6","source":"emo@eclipse.org"}]}},{"cve":{"id":"CVE-2026-102983","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T15:22:22.800","lastModified":"2026-09-30T19:38:27.293","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test(), an allowed origin appearing only in a source URL's path or query can satisfy image.domains or image.remotePatterns while the URL's actual host remains attacker-controlled. An unauthenticated request to the public /.netlify/images endpoint can therefore cause the Image CDN to request attacker-selected URLs and may probe or reach internal services. Netlify egress protections may constrain reachable targets, and image transformation limits direct response exfiltration; no confidentiality or integrity impact has been demonstrated. This issue is fixed in version 8.2.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"withastro","product":"astro","versions":[{"version":">= 5.2.0, < 8.2.4","status":"affected"}]},{"vendor":"@astrojs","product":"netlify","versions":[{"version":">= 5.2.0, < 8.2.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:22:22.386566Z","id":"CVE-2026-102983","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-625"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/withastro/astro/commit/e362d4cf540b27730482455c8fc02efe57d16702","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/pull/17752","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/releases/tag/@astrojs/netlify@8.2.4","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/security/advisories/GHSA-4233-jc72-56c5","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-102984","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T15:22:23.490","lastModified":"2026-09-30T20:17:25.817","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing begins. In the default standalone configuration, the request returns an HTTP 500 response and the server continues running, but when staticHeaders is enabled the synchronous handler does not catch the exception and the Node process terminates. Proxies and CDNs that reject malformed Host headers prevent this path from reaching the origin. The issue affects availability only and does not expose data or permit code execution. This issue is fixed in version 11.1.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"withastro","product":"astro","versions":[{"version":"< 11.1.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:39:13.907814Z","id":"CVE-2026-102984","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-248"}]}],"references":[{"url":"https://github.com/withastro/astro/commit/2066f39c60707a100531b4ef4bb5dab8feafa7f2","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/pull/17572","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/releases/tag/@astrojs/node@11.1.3","source":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/security/advisories/GHSA-qh8j-hqjv-7m4x","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-103222","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T15:22:25.163","lastModified":"2026-09-30T17:16:41.867","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Blosc","product":"C-Blosc2","cpes":["cpe:2.3:a:blosc:c-blosc2:*:*:*:*:*:*:*:*"],"modules":["blosclz Decompression"],"versions":[{"version":"3.3.0","status":"affected"},{"version":"3.3.1","status":"affected"},{"version":"3.3.2","status":"affected"},{"version":"3.3.3","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:P/A:P","baseScore":5.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":4.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:25:43.440256Z","id":"CVE-2026-103222","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-189"},{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/Blosc/c-blosc2/","source":"cna@vuldb.com"},{"url":"https://github.com/Blosc/c-blosc2/commit/fe2964d114d97847f56570a0ab2be2c57ccbeedc","source":"cna@vuldb.com"},{"url":"https://github.com/Blosc/c-blosc2/releases/tag/v3.3.3","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103222","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/954976","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411905","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411905/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103226","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T15:22:25.663","lastModified":"2026-10-15T17:17:10.480","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Artifex","product":"Ghostscript","cpes":["cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*"],"modules":["Pdfwrite"],"versions":[{"version":"10.07","status":"affected"},{"version":"10.08.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:24:46.884908Z","id":"CVE-2026-103226","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://artifex.com/","source":"cna@vuldb.com"},{"url":"https://bugs.ghostscript.com/attachment.cgi?id=28495","source":"cna@vuldb.com"},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709672","source":"cna@vuldb.com"},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3","source":"cna@vuldb.com"},{"url":"https://ghostscript.com/releases/gsdnld.html","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103226","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/955016","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411906","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411906/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103227","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T15:22:26.053","lastModified":"2026-10-02T17:17:01.800","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"GPAC","cpes":["cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*"],"modules":["DASH Client"],"versions":[{"version":"26.07","status":"affected"},{"version":"abi-16.26","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:14:16.271450Z","id":"CVE-2026-103227","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-120"}]}],"references":[{"url":"https://github.com/gpac/gpac/","source":"cna@vuldb.com"},{"url":"https://github.com/gpac/gpac/commit/4c8e26f278ff63eec57968f7bc696f604bb0cffd","source":"cna@vuldb.com"},{"url":"https://github.com/gpac/gpac/issues/3876","source":"cna@vuldb.com"},{"url":"https://github.com/gpac/gpac/pull/3879","source":"cna@vuldb.com"},{"url":"https://github.com/gpac/gpac/releases/tag/abi-16.26","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103227","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/955033","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411908","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411908/cti","source":"cna@vuldb.com"},{"url":"https://github.com/gpac/gpac/issues/3876","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103243","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T15:22:26.607","lastModified":"2026-10-02T17:17:02.293","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ModelTC","product":"LightLLM","defaultStatus":"unaffected","repo":"https://github.com/ModelTC/lightllm","packageURL":"pkg:github/ModelTC/lightllm","versions":[{"version":"0","lessThanOrEqual":"1.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:17:11.695138Z","id":"CVE-2026-103243","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/ModelTC/LightLLM","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/LightLLM/issues/1608","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/multimodal_params.py#L149","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/utils/multimodal_utils.py#L82-L91","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lightllm-through-1.2.0-server-side-request-forgery-via-multimodal-endpoints","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/LightLLM/issues/1608","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103270","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T15:22:26.903","lastModified":"2026-09-30T16:17:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments started with --enable_rl."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ModelTC","product":"LightLLM","defaultStatus":"unaffected","repo":"https://github.com/ModelTC/lightllm","packageURL":"pkg:github/ModelTC/lightllm","versions":[{"version":"0","lessThanOrEqual":"1.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:58:00.673012Z","id":"CVE-2026-103270","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/ModelTC/LightLLM","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/LightLLM/issues/1609","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http.py#L505-L507","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http_rl.py#L51-L139","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lightllm-through-1.2.0-missing-authentication-on-rl-control-routes","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/LightLLM/issues/1609","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103388","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-30T15:22:27.143","lastModified":"2026-09-30T16:17:08.983","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source.\n\nWhen another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim.\n\nPreconditions:\n\n- Attacker must hold galaxy editor privileges (local or via sync).\n\n- Victim must view the affected cluster and click the malicious link.\n\nImpact:\n\n- Stored cross-site scripting (XSS) in the victim's browser.\n\n- Potential session theft, credential harvesting, or unauthorized actions within the MISP application.\n\nAffected: <2.5.48."}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"MISP","product":"MISP","cpes":["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"],"modules":["GalaxyClusters view (default theme)","GalaxyClusters view (Overmind theme)"],"programFiles":["app/View/GalaxyClusters/view.ctp","app/View/Themed/Overmind/Elements/GalaxyClusters/View/galaxy_clusters_general.ctp"],"repo":"https://github.com/MISP/MISP","versions":[{"version":"0","lessThan":"2.5.48","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:58:39.451751Z","id":"CVE-2026-103388","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/MISP/MISP/commit/118528767","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-103389","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-30T15:22:27.417","lastModified":"2026-09-30T16:17:09.187","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated directly into HTML markup by the D3-based correlation graph rendering scripts (both the default and Overmind themes) using the .html() method.\n\nA user holding the perm_galaxy_editor permission, which is granted to the stock User role, could store arbitrary HTML or JavaScript in the icon field. Any other user who opened the correlation graph of an event containing a cluster belonging to that galaxy would have the injected script executed in their browser session.\n\nImpact:\n\n- Arbitrary script execution in the context of the victim's MISP session\n\n- Potential theft of session credentials, manipulation of displayed data, or initiation of actions on behalf of the victim\n\n- Affects both the default and Overmind UI themes\n\nAffected versions: <2.5.48"}],"affected":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","affectedData":[{"vendor":"MISP","product":"MISP","cpes":["cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"],"modules":["Galaxy model","Correlation Graph (default theme)","Correlation Graph (Overmind theme)","Galaxy sync/import capture"],"programFiles":["app/Model/Galaxy.php","app/Lib/Tools/CorrelationGraphTool.php","app/webroot/js/correlation-graph.js","app/webroot/js/correlation-graphOvermind.js"],"repo":"https://github.com/MISP/MISP","versions":[{"version":"0","lessThan":"2.5.48","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:58:27.715153Z","id":"CVE-2026-103389","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/MISP/MISP/commit/8ea5783dd","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}]}},{"cve":{"id":"CVE-2026-103395","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T15:22:27.710","lastModified":"2026-09-30T20:17:30.840","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ModelTC","product":"LightLLM","defaultStatus":"unaffected","repo":"https://github.com/ModelTC/lightllm","packageURL":"pkg:github/ModelTC/lightllm","versions":[{"version":"0","lessThanOrEqual":"1.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:37:06.254439Z","id":"CVE-2026-103395","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/ModelTC/LightLLM","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/LightLLM/issues/1610","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/visualserver/objs.py#L6-L11","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/visualserver/visual_only_manager.py#L138-L140","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-remote-code-execution-via-visual-only-rpyc-service","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/LightLLM/issues/1610","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103396","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T15:22:28.093","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"mlogclub","product":"bbs-go","defaultStatus":"unaffected","repo":"https://github.com/mlogclub/bbs-go","packageURL":"pkg:github/mlogclub/bbs-go","versions":[{"version":"0","lessThanOrEqual":"4.4.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:57:45.943159Z","id":"CVE-2026-103396","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/mlogclub/bbs-go","source":"disclosure@vulncheck.com"},{"url":"https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/handlers/admin/user_handlers.go#L47-L59","source":"disclosure@vulncheck.com"},{"url":"https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/permissions/admin_permission_registry.go#L59-L60","source":"disclosure@vulncheck.com"},{"url":"https://github.com/mlogclub/bbs-go/commit/97d0bb3dcbacd686fd5300295afbf4f4a5da7609","source":"disclosure@vulncheck.com"},{"url":"https://github.com/mlogclub/bbs-go/issues/303","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-incorrect-authorization-via-api-admin-user-synccount","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-103397","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T15:22:28.530","lastModified":"2026-10-02T17:17:02.423","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Liquid-co","product":"OpenSave","defaultStatus":"unaffected","repo":"https://github.com/Liquid-co/OpenSave","packageURL":"pkg:github/Liquid-co/OpenSave","versions":[{"version":"0","lessThan":"2.4.0-beta.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:19:27.231964Z","id":"CVE-2026-103397","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdb","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Liquid-co/OpenSave","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Liquid-co/OpenSave/blob/v2.3.1/internal/p2p/wanclient_handlers.go#L268-L282","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Liquid-co/OpenSave/commit/2f2612b13233ac123e01a03cb3008c44bacaeae3","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/opensave-before-2.4.0-beta.1-authentication-bypass-via-spoofed-relay-sender","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-103398","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T15:22:28.800","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Liquid-co","product":"OpenSave","defaultStatus":"unaffected","repo":"https://github.com/Liquid-co/OpenSave","packageURL":"pkg:github/Liquid-co/OpenSave","versions":[{"version":"0","lessThanOrEqual":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:37:56.394331Z","id":"CVE-2026-103398","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://gist.github.com/mansurmavlankulov/2ca66f95965fb9d4aab353bcf2434cdb","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Liquid-co/OpenSave","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/delta/rootguard.go#L16-L30","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Liquid-co/OpenSave/blob/v2.4.0/internal/p2p/routes.go#L555-L566","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/opensave-through-2.4.0-arbitrary-file-read-and-write-via-peer-controlled-save-path","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-18782","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-30T15:22:30.177","lastModified":"2026-09-30T16:18:57.403","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection.\n\nThis issue affects Trex MES: through 2026-09-29."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"Trex Digital Smart Manufacturing Systems Inc.","product":"Trex MES","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2026-09-29","versionType":"date","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:56:23.205678Z","id":"CVE-2026-18782","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1225","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-18783","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-30T15:22:30.350","lastModified":"2026-09-30T16:18:57.403","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass.\n\nThis issue affects Trex MES: through 2026-09-29."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"Trex Digital Smart Manufacturing Systems Inc.","product":"Trex MES","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2026-09-29","versionType":"date","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:56:59.734462Z","id":"CVE-2026-18783","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1225","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-47097","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T15:22:30.857","lastModified":"2026-09-30T22:16:33.873","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly available firmware image to recover the shared passphrase and decrypt diagnostics export bundles retrieved from the unauthenticated diagnostics endpoint on any affected device, exposing highly sensitive server information."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"AJA Video Systems","product":"HELO Plus","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.1.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:15:04.270365Z","id":"CVE-2026-47097","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://d26ddnfpy9hzf8.cloudfront.net/aja-web/public/pdf/2026/AJA_HELO_PLUS_ReleaseNotes_v2.1.7.pdf","source":"disclosure@vulncheck.com"},{"url":"https://www.aja.com/security-advisories/aja-sa-2026-003","source":"disclosure@vulncheck.com"},{"url":"https://www.aja.com/support/item/10457","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/aja-helo-plus-hardcoded-aes-passphrase-for-diagnostics-export-bundle","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-62084","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T15:22:32.153","lastModified":"2026-09-30T16:17:32.850","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS.\n\nThis issue affects User Submitted Posts: from n/a through 20260810."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Jeff Starr","product":"User Submitted Posts","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"user-submitted-posts","versions":[{"version":"n/a","lessThanOrEqual":"20260810","versionType":"custom","status":"affected","changes":[{"at":"20260916","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:43:10.199923Z","id":"CVE-2026-62084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/user-submitted-posts/vulnerability/wordpress-user-submitted-posts-plugin-20260810-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-62097","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T15:22:32.350","lastModified":"2026-09-30T16:17:32.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPTasty","product":"Business Directory","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"business-directory-plugin","versions":[{"version":"0","lessThanOrEqual":"6.4.27","versionType":"custom","status":"affected","changes":[{"at":"6.4.28","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:42:47.199085Z","id":"CVE-2026-62097","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/business-directory-plugin/vulnerability/wordpress-business-directory-plugin-6-4-27-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-76570","sourceIdentifier":"security@joomla.org","published":"2026-09-30T15:22:34.903","lastModified":"2026-10-06T17:19:45.533","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables  1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomcode.com","product":"JCTables extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-1.20.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"ATTACKED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:59:27.938634Z","id":"CVE-2026-76570","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:joomcode:jc_tables:*:*:*:*:*:joomla\\!:*:*","versionEndExcluding":"1.21.1","matchCriteriaId":"0D375B13-BFC9-4C54-B894-1347C185E813"}]}]}],"references":[{"url":"https://www.joomcode.com/","source":"security@joomla.org","tags":["Product"]},{"url":"https://www.vulncheck.com/blog/jctables-unauthenticated-sql-rw-to-rce","source":"security@joomla.org","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-94545","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T15:22:38.060","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Version 0.33.5 contains a patch. No complete workaround exists besides upgrading. Applications that cannot immediately upgrade should not render attacker-controlled content with Satori."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vercel","product":"satori","versions":[{"version":">= 0.0.27, < 0.33.5","status":"affected"}]},{"vendor":"vercel","product":"next","versions":[{"version":">= 16.2.0, < 16.3.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:41:03.767825Z","id":"CVE-2026-94545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e","source":"security-advisories@github.com"},{"url":"https://github.com/vercel/next.js/releases/tag/v16.3.6","source":"security-advisories@github.com"},{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j","source":"security-advisories@github.com"},{"url":"https://github.com/vercel/satori/commit/26a52affc031216fee5882b6e965c8dbc7ac1782","source":"security-advisories@github.com"},{"url":"https://github.com/vercel/satori/pull/814","source":"security-advisories@github.com"},{"url":"https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-97259","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T15:22:38.463","lastModified":"2026-09-30T16:19:26.343","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Hosting AS","product":"Pay with Vipps for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-vipps","versions":[{"version":"n/a","lessThanOrEqual":"6.2.4","versionType":"custom","status":"affected","changes":[{"at":"6.2.5","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T14:42:59.953080Z","id":"CVE-2026-97259","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-vipps/vulnerability/wordpress-pay-with-vipps-for-woocommerce-plugin-6-2-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-100253","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:55.780","lastModified":"2026-10-06T16:40:33.657","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"TeamCity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2, \n2026.1.4, \n2025.11.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-100253","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*","versionEndExcluding":"2025.11.8","matchCriteriaId":"90B7BA91-8570-4A95-9C06-ABC6182E00A8"},{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1","versionEndExcluding":"2026.1.4","matchCriteriaId":"E68D7A2A-EDCD-4BEF-B205-F6000B6A9AA9"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100254","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:55.947","lastModified":"2026-10-06T16:42:11.860","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"TeamCity","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2026.2, \n2026.1.4, \n2025.11.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-100254","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*","versionEndExcluding":"2025.11.8","matchCriteriaId":"90B7BA91-8570-4A95-9C06-ABC6182E00A8"},{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1","versionEndExcluding":"2026.1.4","matchCriteriaId":"E68D7A2A-EDCD-4BEF-B205-F6000B6A9AA9"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100255","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:56.100","lastModified":"2026-10-02T20:46:45.227","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains TeamCity before 2026.2, \n2026.1.4, \n2025.11.8 administrator account takeover was possible via password reset"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"TeamCity","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2, \n2026.1.4, \n2025.11.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-100255","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1289"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*","versionEndExcluding":"2025.11.8","matchCriteriaId":"90B7BA91-8570-4A95-9C06-ABC6182E00A8"},{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1","versionEndExcluding":"2026.1.4","matchCriteriaId":"E68D7A2A-EDCD-4BEF-B205-F6000B6A9AA9"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100256","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:56.243","lastModified":"2026-10-02T20:44:16.227","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"IntelliJ IDEA","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-100256","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Secondary","description":[{"lang":"en","value":"CWE-829"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.3","matchCriteriaId":"F3015BF8-AF2A-41C5-A3C5-84D1B24F20CC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100257","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:56.390","lastModified":"2026-10-02T20:42:55.907","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.18991","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:35:13.141090Z","id":"CVE-2026-100257","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.18991","matchCriteriaId":"2A03D51E-102A-4E1D-A13E-0DFC43922A73"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100258","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:56.540","lastModified":"2026-10-02T20:36:57.483","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.18991","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:40:21.576627Z","id":"CVE-2026-100258","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-201"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.18991","matchCriteriaId":"2A03D51E-102A-4E1D-A13E-0DFC43922A73"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100259","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:56.683","lastModified":"2026-10-02T20:35:38.773","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.18991","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:39:00.858524Z","id":"CVE-2026-100259","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.18991","matchCriteriaId":"2A03D51E-102A-4E1D-A13E-0DFC43922A73"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100260","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:56.827","lastModified":"2026-10-02T20:29:06.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.18991","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:39:14.796614Z","id":"CVE-2026-100260","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-1188"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.18991","matchCriteriaId":"2A03D51E-102A-4E1D-A13E-0DFC43922A73"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100261","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:56.970","lastModified":"2026-10-02T20:26:24.163","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.18991","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:38:52.350500Z","id":"CVE-2026-100261","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-288"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.18991","matchCriteriaId":"2A03D51E-102A-4E1D-A13E-0DFC43922A73"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100262","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:57.120","lastModified":"2026-10-02T20:25:39.570","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.18991","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:38:29.998536Z","id":"CVE-2026-100262","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.18991","matchCriteriaId":"2A03D51E-102A-4E1D-A13E-0DFC43922A73"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100263","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:57.267","lastModified":"2026-10-02T20:23:31.353","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.18991","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:35:06.223894Z","id":"CVE-2026-100263","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.18991","matchCriteriaId":"2A03D51E-102A-4E1D-A13E-0DFC43922A73"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100264","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:57.407","lastModified":"2026-10-02T17:06:04.663","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.18991","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:34:55.846272Z","id":"CVE-2026-100264","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-522"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.18991","matchCriteriaId":"2A03D51E-102A-4E1D-A13E-0DFC43922A73"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100265","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:57.557","lastModified":"2026-10-02T17:02:03.843","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"Rider","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:34:47.009505Z","id":"CVE-2026-100265","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-494"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:rider:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.1","matchCriteriaId":"6882074F-8413-41BB-AAB6-B70C28B15998"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100266","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:57.707","lastModified":"2026-10-02T16:47:10.860","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"Hub","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.52366","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:34:39.454602Z","id":"CVE-2026-100266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:hub:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.52366","matchCriteriaId":"291D0A56-B353-45C3-AC00-09E05EBF6263"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100267","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:57.853","lastModified":"2026-10-01T15:25:01.563","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:34:30.966300Z","id":"CVE-2026-100267","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-1333"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100268","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:58.000","lastModified":"2026-10-01T15:57:46.837","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:34:12.691308Z","id":"CVE-2026-100268","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100269","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:58.147","lastModified":"2026-10-01T15:59:44.467","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:34:20.554486Z","id":"CVE-2026-100269","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100270","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:58.287","lastModified":"2026-10-02T16:38:13.697","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:34:00.908935Z","id":"CVE-2026-100270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100271","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:58.433","lastModified":"2026-10-02T16:33:51.363","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:33:53.798980Z","id":"CVE-2026-100271","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100272","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:58.577","lastModified":"2026-10-02T16:32:28.710","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:33:37.719460Z","id":"CVE-2026-100272","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100273","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:58.720","lastModified":"2026-10-02T16:30:38.380","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-100273","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100274","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:58.890","lastModified":"2026-10-02T16:18:48.100","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:32:04.675176Z","id":"CVE-2026-100274","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100275","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:59.050","lastModified":"2026-10-02T15:42:06.193","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:31:57.461525Z","id":"CVE-2026-100275","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100276","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:59.223","lastModified":"2026-10-02T16:07:13.533","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:29:14.990484Z","id":"CVE-2026-100276","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100277","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:59.380","lastModified":"2026-10-02T16:01:53.590","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-100277","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100278","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:59.523","lastModified":"2026-10-02T15:56:36.653","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:29:03.259426Z","id":"CVE-2026-100278","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100279","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:59.687","lastModified":"2026-10-02T15:49:59.697","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:28:54.330463Z","id":"CVE-2026-100279","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-100280","sourceIdentifier":"cve@jetbrains.com","published":"2026-09-30T16:16:59.833","lastModified":"2026-10-02T15:47:12.107","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible"}],"affected":[{"source":"cve@jetbrains.com","affectedData":[{"vendor":"JetBrains","product":"YouTrack","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026.2.19197","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@jetbrains.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:28:44.272965Z","id":"CVE-2026-100280","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@jetbrains.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*","versionEndExcluding":"2026.2.19197","matchCriteriaId":"3EC4E0A7-62BB-4635-B70A-154BB40F5FDC"}]}]}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","source":"cve@jetbrains.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102427","sourceIdentifier":"security@joomla.org","published":"2026-09-30T16:17:06.623","lastModified":"2026-10-01T13:46:23.090","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"ordasoft.com","product":"OrdaSoft Joomla CCK","defaultStatus":"unaffected","packageName":"com_os_cck","versions":[{"version":"1.0.0-8.3.15","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"ATTACKED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:37:09.374454Z","id":"CVE-2026-102427","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Primary","description":[{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ordasoft:joomla_cck:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"8.3.16","matchCriteriaId":"F31A166E-8728-42B2-8237-2972F5E79CC2"}]}]}],"references":[{"url":"https://www.ordasoft.com/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-103229","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T16:17:08.243","lastModified":"2026-09-30T16:38:36.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli_query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"AdithyaYelloju","product":"Restaurant-Management-System","cpes":["cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*"],"modules":["Unauthenticated Action Script"],"versions":[{"version":"7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:30:48.048015Z","id":"CVE-2026-103229","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/","source":"cna@vuldb.com"},{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/5","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103229","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/955078","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411922","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411922/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103230","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T16:17:08.463","lastModified":"2026-09-30T20:17:30.187","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the file User/ord.php of the component Order Placement. Executing a manipulation of the argument id/name can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"AdithyaYelloju","product":"Restaurant-Management-System","cpes":["cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*"],"modules":["Order Placement"],"versions":[{"version":"7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:36:18.159434Z","id":"CVE-2026-103230","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/","source":"cna@vuldb.com"},{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/6","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103230","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/955079","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411923","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411923/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103231","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T16:17:08.657","lastModified":"2026-10-02T17:17:01.980","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqli_query of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"AdithyaYelloju","product":"Restaurant-Management-System","cpes":["cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*"],"modules":["Order Cancellation"],"versions":[{"version":"7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:21:31.751140Z","id":"CVE-2026-103231","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/","source":"cna@vuldb.com"},{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/7","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103231","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/955080","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411924","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411924/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103432","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T16:17:09.533","lastModified":"2026-09-30T20:17:31.130","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi), a related issue to CVE-2026-15544."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"apcupsd","product":"apcupsd","defaultStatus":"unknown","modules":["apcupsd-cgi (upsstats.cgi","multimon.cgi","upsfstats.cgi)"],"programFiles":["src/cgi/upsfetch.c"],"versions":[{"version":"0","lessThanOrEqual":"3.14.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:35:14.295763Z","id":"CVE-2026-103432","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493140","source":"cve@mitre.org"},{"url":"https://github.com/therealbstern/apcupsd/blob/224d19d5faa508d04267f6135fe53d50800550de/src/cgi/upsfetch.c#L240","source":"cve@mitre.org"},{"url":"https://sourceforge.net/projects/apcupsd/","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-103436","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T16:17:09.700","lastModified":"2026-10-02T17:17:02.550","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf(\"%*s %*s %s\", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"apcupsd","product":"apcupsd","defaultStatus":"unknown","modules":["apcupsd-cgi (upsstats.cgi","multimon.cgi","upsfstats.cgi)"],"programFiles":["src/cgi/upsfetch.c"],"programRoutines":[{"name":"getupsvar"}],"versions":[{"version":"0","lessThanOrEqual":"3.14.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:20:15.422577Z","id":"CVE-2026-103436","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-457"}]}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493140","source":"cve@mitre.org"},{"url":"https://github.com/therealbstern/apcupsd/blob/224d19d5faa508d04267f6135fe53d50800550de/src/cgi/upsfetch.c#L240","source":"cve@mitre.org"},{"url":"https://sourceforge.net/projects/apcupsd/","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-103441","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T16:17:09.860","lastModified":"2026-09-30T16:27:40.143","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files.\n\nThis issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki Wikibase extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/Wikibase","versions":[{"version":"1.46","status":"affected"},{"version":"1.45","status":"affected"},{"version":"1.43","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:I/V:C/RE:M/U:Red","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"IRRECOVERABLE","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"RED"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/Id35bf747e48370e474d9b9444bd7520b24836e8d","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435210","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103442","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T16:17:10.050","lastModified":"2026-09-30T16:27:40.143","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection.\n\nThis issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki CentralAuth extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/CentralAuth","versions":[{"version":"1.46","status":"affected"},{"version":"1.45","status":"affected"},{"version":"1.43","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-15"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I9c59e5c3f217c1eaa02934a076604049bac2b025","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435624","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103470","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T16:17:10.230","lastModified":"2026-09-30T19:16:40.507","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Internet2","product":"Grouper","defaultStatus":"unaffected","modules":["UI"],"repo":"https://github.com/Internet2/grouper","versions":[{"version":"5.8.3","lessThanOrEqual":"5.22.5","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThan":"6.4.1","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThan":"7.5.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:L/U:Red","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"USER","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"LOW","providerUrgency":"RED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:42:05.790453Z","id":"CVE-2026-103470","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://docs.grouper.internet2.edu/wiki/spaces/Grouper/pages/240549893/","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-47489","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:13.247","lastModified":"2026-09-30T18:18:18.950","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:54:50.317692Z","id":"CVE-2026-47489","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-281"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47489","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47489","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47491","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:13.433","lastModified":"2026-10-01T04:18:05.350","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can cause improper release of memory resources, leaving a mapping accessible after the underlying memory is reused. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47491","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-404"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47491","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47491","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47492","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:13.577","lastModified":"2026-09-30T18:18:19.220","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:48:20.884827Z","id":"CVE-2026-47492","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47492","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47492","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47493","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:13.753","lastModified":"2026-10-01T04:18:05.500","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU resources for which it is not authorized. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47493","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47493","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47493","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47494","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:13.893","lastModified":"2026-10-01T04:18:05.617","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47494","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-134"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47494","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47494","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47495","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:14.030","lastModified":"2026-10-01T04:18:05.740","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47495","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47495","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47495","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47496","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:14.160","lastModified":"2026-10-01T04:18:05.850","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC call to the host. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, and denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47496","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47496","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47496","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47497","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:14.293","lastModified":"2026-10-01T04:18:06.843","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor (GSP) tracing component where a guest VM user may cause improper access by sending crafted data through a shared buffer. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47497","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47497","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47497","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47498","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:14.433","lastModified":"2026-10-01T04:18:06.967","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP) plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC message. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47498","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47498","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47498","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47499","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:14.570","lastModified":"2026-10-01T04:18:07.090","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a guest could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47499","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47499","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47499","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47500","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:14.743","lastModified":"2026-10-01T04:18:07.890","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where improper cleanup of reference counts during error paths could lead to a use-after-free condition. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47500","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47500","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47501","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:14.953","lastModified":"2026-10-01T04:18:08.063","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write by supplying mismatched memory buffers during event buffer setup. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47501","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47501","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47501","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47502","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:15.110","lastModified":"2026-10-01T04:18:08.633","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer, where a guest user could cause an integer overflow leading to memory corruption. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47502","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47502","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47502","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47503","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:15.280","lastModified":"2026-10-01T04:18:08.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest VM user may cause an out-of-bounds write by sending a crafted RPC message with invalid performance state list size parameters. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47503","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47503","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47504","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:15.423","lastModified":"2026-10-01T04:18:09.050","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA Linux GPU Display Driver contains a vulnerability in the NGX updater where an outdated embedded cryptographic library is susceptible to type confusion. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47504","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47504","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47505","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:15.577","lastModified":"2026-10-01T04:18:09.197","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, denial of service, or escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47505","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47505","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47505","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47506","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:15.730","lastModified":"2026-09-30T18:18:21.110","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mode color transform path where excessive kernel stack use occurs when evaluating YCbCr420 display emulation. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:48:11.709860Z","id":"CVE-2026-47506","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47506","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47506","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47507","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:15.907","lastModified":"2026-10-01T04:18:09.330","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds array access. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47507","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47507","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47508","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:16.110","lastModified":"2026-10-01T04:18:09.500","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an incorrect conversion between numeric types. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47508","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47508","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47508","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47509","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:16.280","lastModified":"2026-10-01T04:18:09.677","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47509","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47509","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47509","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47510","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:16.447","lastModified":"2026-10-01T04:18:09.857","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an integer overflow leading to an out-of-bounds write to GPU memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47510","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47510","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47510","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47511","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:16.593","lastModified":"2026-10-01T04:18:10.003","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47511","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47511","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47511","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47512","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:16.740","lastModified":"2026-10-01T04:18:10.147","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read leading to kernel information disclosure. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47512","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47512","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47512","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47513","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:16.903","lastModified":"2026-10-01T04:18:10.307","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read from kernel heap memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47513","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47513","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47513","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47514","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:17.063","lastModified":"2026-10-01T04:18:10.483","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause exposure of kernel stack contents including return addresses and pointers. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47514","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47514","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47514","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47515","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:17.237","lastModified":"2026-10-01T04:18:10.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read via an unbounded string operation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47515","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47515","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47515","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47516","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:17.410","lastModified":"2026-10-01T04:18:10.840","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47516","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47516","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47516","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47517","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:17.570","lastModified":"2026-09-30T18:18:22.773","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode driver where a local user may cause a null pointer dereference by submitting a crafted ioctl. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:48:00.473744Z","id":"CVE-2026-47517","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47517","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47517","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47518","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:17.713","lastModified":"2026-10-01T04:18:11.000","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit of this vulnerability might lead to code execution and escalation of privileges."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":0.5,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47518","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47518","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47518","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47519","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:17.897","lastModified":"2026-10-01T04:18:11.213","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47519","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47519","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47519","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47520","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:18.040","lastModified":"2026-10-01T04:18:11.407","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47520","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47520","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47520","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47521","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:18.187","lastModified":"2026-10-01T04:18:11.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47521","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47521","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47522","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:18.320","lastModified":"2026-10-01T04:18:11.720","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47522","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47522","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47523","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:18.493","lastModified":"2026-10-01T04:18:11.900","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47523","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47523","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47524","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:18.667","lastModified":"2026-10-02T04:18:06.473","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47524","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47524","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47525","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:18.833","lastModified":"2026-10-02T04:18:06.653","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper validation of an array index. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47525","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47525","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47525","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47526","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:19.000","lastModified":"2026-09-30T18:18:24.060","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:45:52.487968Z","id":"CVE-2026-47526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47526","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47526","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47527","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:19.160","lastModified":"2026-10-02T04:18:06.830","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47527","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47527","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47527","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47528","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:19.327","lastModified":"2026-10-01T04:18:12.090","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an access of an uninitialized pointer. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-824"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47528","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47528","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47529","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:19.507","lastModified":"2026-10-02T04:18:07.053","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47529","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47529","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47530","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:19.667","lastModified":"2026-10-01T04:18:12.260","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47530","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47530","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47531","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:19.833","lastModified":"2026-09-30T18:18:24.860","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:45:44.005661Z","id":"CVE-2026-47531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47531","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47531","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47532","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:19.997","lastModified":"2026-10-01T04:18:12.427","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47532","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47532","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47532","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47533","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:20.157","lastModified":"2026-10-01T04:18:12.593","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper validation of an array index. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47533","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47533","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47533","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47534","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:20.320","lastModified":"2026-09-30T18:18:25.330","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause a divide by zero. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:42:54.660207Z","id":"CVE-2026-47534","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-369"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47534","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47534","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47535","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:20.523","lastModified":"2026-10-01T04:18:12.763","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47535","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47535","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47536","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:20.677","lastModified":"2026-10-01T04:18:12.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47536","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47536","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47536","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47537","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:20.810","lastModified":"2026-10-01T04:18:13.030","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47537","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47537","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47537","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47538","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:20.973","lastModified":"2026-10-01T04:18:13.227","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47538","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47538","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47538","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47539","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:21.143","lastModified":"2026-10-01T04:18:13.400","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect numeric conversion. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47539","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47539","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47540","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:21.290","lastModified":"2026-10-01T04:18:13.583","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47540","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47540","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47540","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47541","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:21.470","lastModified":"2026-10-01T04:18:13.790","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47541","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47541","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47542","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:21.613","lastModified":"2026-10-01T04:18:13.943","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47542","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47542","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47543","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:21.797","lastModified":"2026-10-01T04:18:14.107","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"VIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47543","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47543","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47544","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:21.967","lastModified":"2026-10-01T04:18:14.283","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47544","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47544","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47544","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47545","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:22.100","lastModified":"2026-10-01T04:18:14.437","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47545","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47545","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47546","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:22.277","lastModified":"2026-10-01T04:18:14.617","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47546","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47546","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47547","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:22.437","lastModified":"2026-10-01T04:18:14.793","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47547","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47547","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47548","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:22.600","lastModified":"2026-10-01T04:18:14.967","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47548","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47548","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47549","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:22.783","lastModified":"2026-09-30T18:18:27.497","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel module where an unprivileged local user could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:42:49.289382Z","id":"CVE-2026-47549","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47549","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47549","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47550","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:22.937","lastModified":"2026-10-01T04:18:15.137","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an unprivileged local user can supply an untrusted pointer that the driver dereferences without validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47550","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47550","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47550","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47551","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:23.080","lastModified":"2026-10-01T04:18:15.283","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47551","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47551","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47551","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47552","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:23.263","lastModified":"2026-10-01T04:18:15.463","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass an authorization check and modify privileged configuration. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47552","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47552","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47552","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47553","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:23.410","lastModified":"2026-10-01T04:18:15.623","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47553","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47553","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47553","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47554","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:23.587","lastModified":"2026-09-30T18:18:28.237","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signatures may cause signature verification to be bypassed under memory pressure. A successful exploit of this vulnerability might lead to denial of service and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:17:05.888287Z","id":"CVE-2026-47554","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47554","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47554","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47555","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:23.733","lastModified":"2026-09-30T18:18:28.367","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause uninitialized kernel memory to be copied back to userspace. A successful exploit of this vulnerability might lead to information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:42:41.128885Z","id":"CVE-2026-47555","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47555","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47555","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47556","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:23.913","lastModified":"2026-10-01T04:18:15.797","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an integer overflow that leads to an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47556","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47556","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47556","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47557","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:24.080","lastModified":"2026-09-30T18:18:28.687","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:42:32.882065Z","id":"CVE-2026-47557","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47557","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47557","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47558","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:24.227","lastModified":"2026-10-01T04:18:15.973","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-415"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47558","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47558","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47559","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:24.373","lastModified":"2026-10-01T04:18:16.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could access memory belonging to another user's process. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47559","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47559","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47559","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47560","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:24.547","lastModified":"2026-10-01T04:18:16.303","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47560","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47560","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47560","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47561","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:24.693","lastModified":"2026-10-01T04:18:16.450","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47561","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47561","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47561","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47562","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:24.847","lastModified":"2026-09-30T18:18:29.383","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:45:35.625550Z","id":"CVE-2026-47562","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47562","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47562","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47563","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:25.040","lastModified":"2026-10-01T04:18:16.623","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47563","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47563","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47563","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47565","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:25.210","lastModified":"2026-10-01T04:18:16.790","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a privileged user could trigger a race condition that leads to an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47565","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47565","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47565","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47566","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:25.357","lastModified":"2026-09-30T18:18:29.797","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a memory leak in error paths leading to kernel memory exhaustion. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:42:26.518892Z","id":"CVE-2026-47566","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-401"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47566","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47566","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47567","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:25.507","lastModified":"2026-09-30T18:18:29.937","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a user could cause uncontrolled resource consumption by exhausting the DRM VMA offset address space. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:42:19.003143Z","id":"CVE-2026-47567","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47567","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47567","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47568","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:25.663","lastModified":"2026-09-30T18:18:30.113","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause uncontrolled kernel log generation by repeatedly invoking an interface that emits unrate-limited error messages. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:42:09.152077Z","id":"CVE-2026-47568","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47568","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47568","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47569","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:25.827","lastModified":"2026-10-01T04:18:16.937","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a type confusion via a handle recycle race. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47569","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47569","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47569","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47570","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:25.970","lastModified":"2026-10-02T04:18:07.227","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from an uncontrolled search path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47570","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-427"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47570","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47570","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47571","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:26.123","lastModified":"2026-10-02T04:18:07.370","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in kernel-mode escape handling where an attacker with local access could bypass an authorization check that is intended to restrict certain operations based on client execution context. A successful exploit of this vulnerability might lead to escalation of privilege, information disclosure, data tampering, denial of service, or code execution."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47571","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47571","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47571","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47572","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:26.297","lastModified":"2026-10-02T04:18:07.527","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause type confusion. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47572","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47572","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47572","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47573","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:26.437","lastModified":"2026-10-02T04:18:07.713","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47573","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47573","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47574","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:26.580","lastModified":"2026-10-01T04:18:17.090","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker could cause incorrect resource transfer between spheres. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-669"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47574","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47574","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47575","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:26.710","lastModified":"2026-09-30T18:18:32.497","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the display driver DIAG escape handler where a local unprivileged attacker may cause an integer overflow and out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, and code execution."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:52:50.363146Z","id":"CVE-2026-47575","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47575","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47575","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47576","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:26.850","lastModified":"2026-09-30T18:18:32.613","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module through which an attacker might initiate an out-of-bounds read. Successful exploitation of this issue could lead to denial of service and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:16:55.958446Z","id":"CVE-2026-47576","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47576","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47576","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47577","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:26.990","lastModified":"2026-10-01T04:18:17.233","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an incorrect comparison. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47577","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47577","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47578","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:27.130","lastModified":"2026-10-01T04:18:17.383","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect buffer size calculation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47578","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-131"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47578","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47578","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47579","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:27.273","lastModified":"2026-10-01T04:18:17.530","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode driver through which a user might trigger a use-after-free condition. Successful exploitation of this issue could lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47579","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47579","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47580","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:27.423","lastModified":"2026-09-30T18:18:33.130","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.0,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:17:15.181410Z","id":"CVE-2026-47580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47580","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47580","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47581","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:27.563","lastModified":"2026-09-30T18:18:33.253","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where a user could cause improper locking. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:42:00.441858Z","id":"CVE-2026-47581","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-667"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47581","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47581","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47582","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:27.710","lastModified":"2026-10-01T04:18:17.673","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47582","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47582","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47582","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47583","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:27.857","lastModified":"2026-10-01T04:18:17.827","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause type confusion. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47583","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47583","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47583","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47584","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:27.990","lastModified":"2026-09-30T18:18:33.667","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker with local access could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:41:53.842578Z","id":"CVE-2026-47584","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47584","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47584","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47585","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:28.137","lastModified":"2026-10-01T04:18:17.977","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior  to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47585","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47585","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47586","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:28.283","lastModified":"2026-09-30T18:18:33.910","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel module where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:48:03.730676Z","id":"CVE-2026-47586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47586","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47586","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47587","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:28.443","lastModified":"2026-10-01T04:18:18.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47587","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47587","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47588","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:28.577","lastModified":"2026-10-02T04:18:07.870","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47588","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47588","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47589","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:28.733","lastModified":"2026-10-02T04:18:08.047","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47589","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47589","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47590","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:28.897","lastModified":"2026-10-02T04:18:08.213","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47590","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47590","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47591","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:29.053","lastModified":"2026-10-02T04:18:08.390","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47591","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47591","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47592","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:29.200","lastModified":"2026-10-02T04:18:08.560","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47592","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47592","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47592","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47593","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:29.370","lastModified":"2026-10-02T04:18:08.737","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an unprivileged user can cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, and denial of service."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47593","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47593","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47593","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47594","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:29.513","lastModified":"2026-10-02T04:18:08.897","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47594","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47594","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47595","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:29.680","lastModified":"2026-10-02T04:18:09.110","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memory because the memory's permissions are not preserved. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T00:00:00+00:00","id":"CVE-2026-47595","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-281"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47595","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47595","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47596","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:29.827","lastModified":"2026-09-30T18:18:35.687","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memory because the memory's permissions are not preserved. A successful exploit of this vulnerability might lead to code execution and escalation of privileges."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"PHYSICAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.4,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:14:24.873979Z","id":"CVE-2026-47596","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-281"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47596","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47596","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47597","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:29.963","lastModified":"2026-10-01T04:18:18.260","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module Resource Server where an unprivileged local user could cause a use-after-free through a missing self-reference guard in the map cleanup path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47597","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47597","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47597","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47598","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:30.123","lastModified":"2026-10-01T04:18:18.440","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module event delivery path where an unprivileged local user could cause a use-after-free through a race between asynchronous event delivery and file close. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47598","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47598","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47598","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47599","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:30.270","lastModified":"2026-10-01T04:18:18.593","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module where an unprivileged local user could cause improper preservation of memory access permissions during DMA mapping. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47599","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-281"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47599","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47599","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47600","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:30.400","lastModified":"2026-10-01T04:18:18.747","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an error-handling path could operate on an improperly initialized resource. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47600","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-908"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47600","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47600","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47601","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:30.563","lastModified":"2026-10-01T04:18:18.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module DMA-BUF import path where an unprivileged local user could cause improper preservation of memory access permissions when importing a read-only buffer from another device's DMA-BUF exporter. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T00:00:00+00:00","id":"CVE-2026-47601","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47601","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47601","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47602","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:30.733","lastModified":"2026-09-30T18:18:36.560","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user can cause the driver to dereference an untrusted pointer. A successful exploit of this vulnerability might lead to denial of service and information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.60","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:16:46.008990Z","id":"CVE-2026-47602","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47602","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47602","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47603","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:30.907","lastModified":"2026-09-30T18:18:36.727","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:41:47.656066Z","id":"CVE-2026-47603","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47603","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47603","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-47604","sourceIdentifier":"psirt@nvidia.com","published":"2026-09-30T16:17:31.087","lastModified":"2026-09-30T18:18:36.900","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure."}],"affected":[{"source":"psirt@nvidia.com","affectedData":[{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.56","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to  616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 582.78","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R595)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R580)"],"versions":[{"version":"All driver versions prior to 596.86","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R615)"],"versions":[{"version":"All driver versions prior to 616.92","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Windows(R610)"],"versions":[{"version":"All driver versions prior to 610.88","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"RTX, Quadro, NVS","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R615)"],"versions":[{"version":"All driver versions prior to 615.71.09","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R610)"],"versions":[{"version":"All driver versions prior to 610.57.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"Tesla","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R595)"],"versions":[{"version":"All driver versions prior to 595.91.07","status":"affected"}]},{"vendor":"NVIDIA","product":"GeForce","defaultStatus":"unaffected","platforms":["Linux(R580)"],"versions":[{"version":"All driver versions prior to 580.178.04","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 20)"],"versions":[{"version":"596.36(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Windows(vGPU 19)"],"versions":[{"version":"582.53(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 20)"],"versions":[{"version":"595.71.05(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Guest driver","defaultStatus":"unaffected","platforms":["Linux(vGPU 19)"],"versions":[{"version":"580.159.03(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"],"versions":[{"version":"595.71.03(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"],"versions":[{"version":"580.159.01(All versions prior to and including vGPU 19.5)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 20)"],"versions":[{"version":"596.38(All versions prior to and including vGPU 20.1)","status":"affected"}]},{"vendor":"NVIDIA","product":"Virtual GPU Manager","defaultStatus":"unaffected","platforms":["Azure Local, Windows Server(vGPU 19)"],"versions":[{"version":"582.51(All versions prior to and including vGPU 19.5)","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@nvidia.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T16:45:58.913327Z","id":"CVE-2026-47604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@nvidia.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5861","source":"psirt@nvidia.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47604","source":"psirt@nvidia.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47604","source":"psirt@nvidia.com"}]}},{"cve":{"id":"CVE-2026-55174","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T16:17:31.457","lastModified":"2026-09-30T20:17:33.243","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose \"r\" value is not cryptographically bound to the adaptor point \"T\". This issue has been patched in version 4.2.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"shrec","product":"UltrafastSecp256k1","versions":[{"version":"< 4.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:51:52.522461Z","id":"CVE-2026-55174","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/shrec/UltrafastSecp256k1/commit/5478ef566c6af91b48a45c0c61f161f5b1071981","source":"security-advisories@github.com"},{"url":"https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.0","source":"security-advisories@github.com"},{"url":"https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.1","source":"security-advisories@github.com"},{"url":"https://github.com/shrec/UltrafastSecp256k1/security/advisories/GHSA-c7q2-gv3g-rgxm","source":"security-advisories@github.com"},{"url":"https://github.com/shrec/UltrafastSecp256k1/security/advisories/GHSA-c7q2-gv3g-rgxm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-80490","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-09-30T16:19:10.127","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified.\n\nThe matches, first_match and match_details methods use the T_STD_STRING typemap to translate Perl scalars (SVs) into strings via the std::string constructor, using the SvPV macro to stringify the haystack input, and the SvCUR macro to determine the length of the SV.\n\nWhen the input SVs are references, integers (IVs) or floats (NVs), the SvCUR macro will return an invalid length if it is run before the input is stringified, leading to an out-of-bounds read which can abort the process.\n\nNote that the evaluation order of arguments to std::string is unspecified. Depending on the compiler, SvCUR may be run first and lead to an abort that cannot be caught within Perl.\n\nThis can be triggered when the haystack is a numeric value, for example,\n\n    my $ac = Algorithm::AhoCorasick::XS->new( [ \"11\", \"22\" ] );\n    $ac->matches( 211 );\n\nThis can occur when the haystack is the result of reading data from decoded JSON or a numeric database column. It can also be triggered when using a blessed object as a haystack."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Algorithm-AhoCorasick-XS","modules":["Algorithm::AhoCorasick::XS"],"programFiles":["typemap"],"programRoutines":[{"name":"Algorithm::AhoCorasick::XS::first_match"},{"name":"Algorithm::AhoCorasick::XS::matches"},{"name":"Algorithm::AhoCorasick::XS::match_details"}],"repo":"https://github.com/richardjharris/Algorithm-AhoCorasick-XS","packageURL":"pkg:cpan/Algorithm-AhoCorasick-XS","versions":[{"version":"0","lessThanOrEqual":"0.04","versionType":"custom","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/richardjharris/Algorithm-AhoCorasick-XS/pull/1","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/RJH/Algorithm-AhoCorasick-XS-0.04/source/typemap#L14","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://rt.cpan.org/Ticket/Display.html?id=181560","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://security.metacpan.org/patches/A/Algorithm-AhoCorasick-XS/0.04/CVE-2026-80490-r1.patch","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/15","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-102489","sourceIdentifier":"csirt@divd.nl","published":"2026-09-30T17:16:40.550","lastModified":"2026-10-10T04:18:08.040","vulnStatus":"Analyzed","cveTags":[{"sourceIdentifier":"csirt@divd.nl","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Zammad GmbH","product":"Zammad","defaultStatus":"unaffected","platforms":["Linux","Docker"],"versions":[{"version":"*","lessThan":"6.3.0","versionType":"semver","status":"unknown"},{"version":"6.3.0","lessThan":"6.5.4","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThan":"7.1.3","versionType":"semver","status":"unknown"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"ATTACKED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T00:00:00+00:00","id":"CVE-2026-102489","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-10-02","cisaActionDue":"2026-10-05","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Zammad GmbH Zammad Session Fixation Vulnerability","weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-384"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-384"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3.0","versionEndIncluding":"6.5.4","matchCriteriaId":"20D0A6CD-50AC-46AD-91BE-6B4DC96B405A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:docker:docker:-:*:*:*:*:*:*:*","matchCriteriaId":"231A8A55-A319-4878-91DA-4FD91CF0549E"},{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2","source":"csirt@divd.nl","tags":["Vendor Advisory"]},{"url":"https://csirt.divd.nl/CVE-2026-102489","source":"csirt@divd.nl","tags":["Third Party Advisory"]},{"url":"https://csirt.divd.nl/DIVD-2026-00015","source":"csirt@divd.nl","tags":["Third Party Advisory"]},{"url":"https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490","source":"csirt@divd.nl","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}},{"cve":{"id":"CVE-2026-102490","sourceIdentifier":"csirt@divd.nl","published":"2026-09-30T17:16:40.707","lastModified":"2026-10-09T14:21:05.030","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected."}],"affected":[{"source":"csirt@divd.nl","affectedData":[{"vendor":"Zammad GmbH","product":"Zammad","defaultStatus":"unaffected","platforms":["Linux"],"versions":[{"version":"1.5.0","lessThan":"7.2.2","versionType":"semver","status":"affected"},{"version":"*","lessThan":"1.5.0","versionType":"semver","status":"unknown"},{"version":"7.2.2","lessThan":"*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"csirt@divd.nl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"ATTACKED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T00:00:00+00:00","id":"CVE-2026-102490","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-10-02","cisaActionDue":"2026-10-05","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Zammad GmbH Zammad Improper Privilege Management Vulnerability","weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.2","matchCriteriaId":"AFB98E46-4992-432C-B2E4-7FECE351AE66"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:docker:docker:-:*:*:*:*:*:*:*","matchCriteriaId":"231A8A55-A319-4878-91DA-4FD91CF0549E"},{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://csirt.divd.nl/CVE-2026-102490","source":"csirt@divd.nl","tags":["Third Party Advisory"]},{"url":"https://csirt.divd.nl/DIVD-2026-00015","source":"csirt@divd.nl","tags":["Third Party Advisory"]},{"url":"https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq","source":"csirt@divd.nl","tags":["Vendor Advisory"]},{"url":"https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490","source":"csirt@divd.nl","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}},{"cve":{"id":"CVE-2026-103232","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T17:16:42.000","lastModified":"2026-09-30T18:18:15.767","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/table_booking.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"AdithyaYelloju","product":"Restaurant-Management-System","cpes":["cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*"],"versions":[{"version":"7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:02:53.430445Z","id":"CVE-2026-103232","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/","source":"cna@vuldb.com"},{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/8","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103232","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/955081","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411926","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411926/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103233","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T17:16:42.177","lastModified":"2026-09-30T20:17:30.453","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"AdithyaYelloju","product":"Restaurant-Management-System","cpes":["cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*"],"modules":["Admin Area"],"versions":[{"version":"7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:28:04.699556Z","id":"CVE-2026-103233","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/","source":"cna@vuldb.com"},{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/9","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103233","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/955096","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411927","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/411927/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103241","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T17:16:42.570","lastModified":"2026-10-06T17:14:37.097","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"vllm-project","product":"vLLM","cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"modules":["Gemma4UnifiedParser"],"versions":[{"version":"0.1","status":"affected"},{"version":"0.2","status":"affected"},{"version":"0.3","status":"affected"},{"version":"0.4","status":"affected"},{"version":"0.5","status":"affected"},{"version":"0.6","status":"affected"},{"version":"0.7","status":"affected"},{"version":"0.8","status":"affected"},{"version":"0.9","status":"affected"},{"version":"0.10","status":"affected"},{"version":"0.11","status":"affected"},{"version":"0.12","status":"affected"},{"version":"0.13","status":"affected"},{"version":"0.14","status":"affected"},{"version":"0.15","status":"affected"},{"version":"0.16","status":"affected"},{"version":"0.17","status":"affected"},{"version":"0.18","status":"affected"},{"version":"0.19","status":"affected"},{"version":"0.20","status":"affected"},{"version":"0.21","status":"affected"},{"version":"0.22","status":"affected"},{"version":"0.23","status":"affected"},{"version":"0.24","status":"affected"},{"version":"0.25","status":"affected"},{"version":"0.26.0","status":"affected"},{"version":"0.29.1rc0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:23:38.542254Z","id":"CVE-2026-103241","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-404"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndIncluding":"0.26.0","matchCriteriaId":"9E8FA0F7-6041-4143-A4ED-582B13E17604"}]}]}],"references":[{"url":"https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e","source":"cna@vuldb.com","tags":["Product"]},{"url":"https://github.com/vllm-project/vllm/","source":"cna@vuldb.com","tags":["Product"]},{"url":"https://github.com/vllm-project/vllm/commit/3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9","source":"cna@vuldb.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/issues/50927","source":"cna@vuldb.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/54303","source":"cna@vuldb.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.29.1rc0","source":"cna@vuldb.com","tags":["Release Notes"]},{"url":"https://vuldb.com/cve/CVE-2026-103241","source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/submit/956250","source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/vuln/411965","source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/vuln/411965/cti","source":"cna@vuldb.com","tags":["Permissions Required","VDB Entry"]}]}},{"cve":{"id":"CVE-2026-103443","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T17:16:43.030","lastModified":"2026-09-30T21:17:09.063","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements.\n\nThis issue affects MediaWiki Collection (Book) extension: 1.46, 1.45, and 1.43."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki Collection (Book) extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/Collection","versions":[{"version":"1.46","status":"affected"},{"version":"1.45","status":"affected"},{"version":"1.43","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","baseScore":1.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:13:04.341673Z","id":"CVE-2026-103443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I51d973d4ace99fb6e584296f296efb0ff50339ce","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435822","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103444","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T17:16:43.177","lastModified":"2026-09-30T21:17:09.180","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS.\n\nThis issue affects MediaWiki WikiForum extension: master."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki WikiForum extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/WikiForum","versions":[{"version":"master","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","baseScore":1.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:12:54.866926Z","id":"CVE-2026-103444","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I7849ef0f9c3eff48fd63e47e5b8affc3b25bb4dd","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T414227","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-19445","sourceIdentifier":"cna@python.org","published":"2026-09-30T17:16:45.720","lastModified":"2026-10-03T01:17:24.930","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected."}],"affected":[{"source":"cna@python.org","affectedData":[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["ssl"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.10.22","versionType":"python","status":"affected"},{"version":"3.11.0","lessThan":"3.11.17","versionType":"python","status":"affected"},{"version":"3.12.0","lessThan":"3.12.15","versionType":"python","status":"affected"},{"version":"3.13.0","lessThan":"3.13.16","versionType":"python","status":"affected"},{"version":"3.14.0","lessThan":"3.14.8","versionType":"python","status":"affected"},{"version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@python.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"cna@python.org","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b","source":"cna@python.org"},{"url":"https://github.com/python/cpython/issues/156293","source":"cna@python.org"},{"url":"https://github.com/python/cpython/pull/158504","source":"cna@python.org"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/","source":"cna@python.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/17","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-19553","sourceIdentifier":"cna@python.org","published":"2026-09-30T17:16:45.880","lastModified":"2026-10-16T19:17:06.673","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied."}],"affected":[{"source":"cna@python.org","affectedData":[{"vendor":"Python Software Foundation","product":"CPython","defaultStatus":"unaffected","modules":["ssl"],"repo":"https://github.com/python/cpython","versions":[{"version":"0","lessThan":"3.10.22","versionType":"python","status":"affected"},{"version":"3.11.0","lessThan":"3.11.17","versionType":"python","status":"affected"},{"version":"3.12.0","lessThan":"3.12.15","versionType":"python","status":"affected"},{"version":"3.13.0","lessThan":"3.13.16","versionType":"python","status":"affected"},{"version":"3.14.0","lessThan":"3.14.8","versionType":"python","status":"affected"},{"version":"3.15.0a1","lessThan":"3.15.0rc3","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@python.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T18:33:08.291056Z","id":"CVE-2026-19553","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@python.org","type":"Secondary","description":[{"lang":"en","value":"CWE-297"}]}],"references":[{"url":"https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80","source":"cna@python.org"},{"url":"https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062","source":"cna@python.org"},{"url":"https://github.com/python/cpython/issues/156793","source":"cna@python.org"},{"url":"https://github.com/python/cpython/pull/158503","source":"cna@python.org"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/","source":"cna@python.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/30/16","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-46711","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T17:16:46.060","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/<path>, /archive/<dir>) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Soft-Machine-io","product":"security","versions":[{"version":"<= 0.2.247","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.7,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:01:41.415498Z","id":"CVE-2026-46711","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/Soft-Machine-io/security/security/advisories/GHSA-h6g6-qr45-qmrr","source":"security-advisories@github.com"},{"url":"https://github.com/Soft-Machine-io/security/security/advisories/GHSA-h6g6-qr45-qmrr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-55176","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T17:16:46.630","lastModified":"2026-10-02T17:17:06.177","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth() and authenticateWorkspaceHttp() — accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying which workspace the caller belongs to. Because that secret is set identically on every container in the Fly app and is reachable from the user-facing process environment inside each workspace, any tenant can use it to authenticate to any other tenant's workspace API. The result is cross-workspace read, write, and destructive-restore primitives reachable from any paying customer's shell. The existing per-workspace token check (workspaceTokenMatches) protects the user-facing per-workspace token path, but the shared-secret bearer path bypasses it entirely. At time of publication, there are no publicly known patches."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Soft-Machine-io","product":"security","versions":[{"version":"<= 0.2.247","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:22:21.804846Z","id":"CVE-2026-55176","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/Soft-Machine-io/security/security/advisories/GHSA-63gh-vp9f-vxhj","source":"security-advisories@github.com"},{"url":"https://github.com/Soft-Machine-io/security/security/advisories/GHSA-63gh-vp9f-vxhj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-55177","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T17:16:46.787","lastModified":"2026-09-30T20:17:33.477","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family (api/routes/esri.ts) takes a fully attacker-controlled URL from the request (POST /api/esri body url, and the portal / server / layer query parameters on the GET /api/esri/* routes) and passes it into EsriBase / EsriProxyPortal / EsriProxyServer / EsriProxyLayer in api/lib/esri.ts, which fetch it with the bare fetch from @tak-ps/etl. No IP / DNS / hostname classification is applied at any point, so the destination is never validated against private, loopback, or link-local ranges. Any authenticated user (the routes only require Auth.is_auth(config, req, { anyResources: true }), i.e. any token, not an admin) can therefore make the CloudTAK server issue arbitrary outbound GET/POST requests to internal addresses such as the cloud instance-metadata service (169.254.169.254), loopback admin ports (127.0.0.1:<port>), and other hosts reachable only from inside the deployment VPC. This is a full-read SSRF, not blind: on success the upstream JSON body is returned to the caller via res.json(...), and on failure the upstream error string is reflected verbatim as ESRI Server Error: <message>. An attacker can read cloud metadata (and the temporary IAM credentials the instance role exposes), enumerate internal services, and exfiltrate their response bodies. The sniff() URL classifier provides no protection: it only pattern-matches the pathname (/rest, /arcgis/rest, /sharing/rest), so a URL like http://169.254.169.254/arcgis/rest or http://127.0.0.1:8500/rest passes sniff() and is fetched. This issue has been patched in version 13.10.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"dfpc-coe","product":"CloudTAK","versions":[{"version":"< 13.10.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:32:16.314025Z","id":"CVE-2026-55177","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.10.0","source":"security-advisories@github.com"},{"url":"https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-r95q-fp26-h3hc","source":"security-advisories@github.com"},{"url":"https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-r95q-fp26-h3hc","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-55181","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T17:16:46.937","lastModified":"2026-09-30T20:17:33.650","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to /auth/oidc/login still starts the OIDC login flow, returns HTTP 302, sets an oidc_state cookie, and redirects the user to the configured OIDC authorization endpoint. This bypasses the intended OIDC disable switch. This issue has been patched in version 1.30.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Quenary","product":"tugtainer","versions":[{"version":"< 1.30.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:50:35.786345Z","id":"CVE-2026-55181","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/Quenary/tugtainer/commit/76371db679334b002d4af544b0f3b8587ad86f52","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/releases/tag/v1.30.3","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/security/advisories/GHSA-rg7c-vpfp-2w43","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/security/advisories/GHSA-rg7c-vpfp-2w43","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-55494","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T17:16:47.100","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py, the signature verification function returns successfully if Config.AGENT_SECRET is empty. This causes protected Agent APIs to become accessible without authentication. This issue has been patched in version 1.30.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Quenary","product":"tugtainer","versions":[{"version":"< 1.30.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:12:48.476039Z","id":"CVE-2026-55494","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/Quenary/tugtainer/commit/0052a5544e187a4d12f771838a8a23ca4afb61cd","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/releases/tag/v1.30.4","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/security/advisories/GHSA-wgw2-c96g-p7h7","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/security/advisories/GHSA-wgw2-c96g-p7h7","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-62308","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T17:16:49.423","lastModified":"2026-09-30T20:17:34.140","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocols, hostnames, localhost addresses, private IP ranges, or cloud metadata addresses. This can be abused as an authenticated blind server-side request forgery (SSRF). This issue has been patched in version 1.30.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Quenary","product":"tugtainer","versions":[{"version":"< 1.30.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":5.3}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:26:48.772147Z","id":"CVE-2026-62308","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/Quenary/tugtainer/commit/c0294d0ab64985b135d0c5b566ac30bf8371f9c3","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/releases/tag/v1.30.6","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/security/advisories/GHSA-c2h5-ppv9-7vrq","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/security/advisories/GHSA-c2h5-ppv9-7vrq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-75969","sourceIdentifier":"16cac6a8-cc1e-4741-89aa-6b97e2437706","published":"2026-09-30T17:16:49.583","lastModified":"2026-09-30T21:17:13.377","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified firmware on the device without administrator credentials.\n\n\n\nThis vulnerability allows attackers to upload modified firmware to the device without admin credentials. This issue affects:\n\n\n\n\n\n  *  Move 4K 12X before: 0.0.98\n  *  Move 4K 20X before: 0.1.33\n  *  Move 4K 30X before: 2.1.17\n  *  Link 4K 12X before: 0.0.99\n  *  Link 4K 20X before: 0.1.37\n  *  Link 4K 30X before: 2.1.18\n  *  Move SE 12X before: 9.1.66\n  *  Move SE 20X before: 9.1.44\n  *  Move SE 30X before: 9.1.46\n  *  Studio 4K 12X before: 8.3.32\n  *  Studio 4K 20X before: 8.3.32\n  *  Studio SE 12X before: 8.3.32\n  *  Studio SE 20X before: 8.3.32\n  *  All Generation 2 cameras, including: PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2; PT12X-USB-GY-G2, PT12X-USB-WH-G2; PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2; PT20X-USB-GY-G2, PT20X-USB-WH-G2; PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2; PTVL-ZCAM, PTVL-NDI-ZCAM; PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2; PT12X-ZCAM, PT12X-NDI-ZCAM; PT20X-ZCAM, PT20X-NDI-ZCAM; Studio Pro - All versions\n  *  Upgrade Tool - All versions"}],"affected":[{"source":"16cac6a8-cc1e-4741-89aa-6b97e2437706","affectedData":[{"vendor":"PTZOptics","product":"Move 4K 12X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"0.0.98","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Move 4K 20X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"0.1.33","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Move 4K 30X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"2.1.17","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Link 4K 12X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"0.0.99","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Link 4K 20X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"0.1.37","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Link 4K 30X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"2.1.18","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Move SE 12X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"9.1.66","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Move SE 20X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"9.1.44","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Move SE 30X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"9.1.46","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Studio 4K 12X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"8.3.32","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Studio 4K 20X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"8.3.32","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Studio SE 12X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"8.3.32","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Studio SE 20X","defaultStatus":"unaffected","modules":["Firmware Update"],"versions":[{"version":"0","lessThan":"8.3.32","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"PT12X-SDI-GY-G2, PT12X-SDI-WH-G2, PT12X-NDI-GY-G2, PT12X-NDI-WH-G2","defaultStatus":"affected","modules":["Firmware Update"],"versions":[{"version":"0","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"PT12X-USB-GY-G2, PT12X-USB-WH-G2","defaultStatus":"affected","modules":["Firmware Update"],"versions":[{"version":"0","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"PT20X-SDI-GY-G2, PT20X-SDI-WH-G2, PT20X-NDI-GY-G2, PT20X-NDI-WH-G2","defaultStatus":"affected","modules":["Firmware Update"],"versions":[{"version":"0","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"PT20X-USB-GY-G2, PT20X-USB-WH-G2","defaultStatus":"affected","modules":["Firmware Update"],"versions":[{"version":"0","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"PT30X-SDI-GY-G2, PT30X-SDI-WH-G2, PT30X-NDI-GY-G2, PT30X-NDI-WH-G2","defaultStatus":"affected","modules":["Firmware Update"],"versions":[{"version":"0","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"PTVL-ZCAM, PTVL-NDI-ZCAM","defaultStatus":"affected","modules":["Firmware Update"],"versions":[{"version":"0","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"PTEPTZ-ZCAM-G2, PTEPTZ-NDI-ZCAM-G2","defaultStatus":"affected","modules":["Firmware Update"],"versions":[{"version":"0","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"PT12X-ZCAM, PT12X-NDI-ZCAM","defaultStatus":"affected","modules":["Firmware Update"],"versions":[{"version":"0","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"PT20X-ZCAM, PT20X-NDI-ZCAM","defaultStatus":"affected","modules":["Firmware Update"],"versions":[{"version":"0","versionType":"custom","status":"affected"}]},{"vendor":"PTZOptics","product":"Studio Pro","defaultStatus":"affected","versions":[{"version":"0","status":"affected"}]},{"vendor":"PTZOptics","product":"Upgrade Tool","defaultStatus":"affected","modules":["Firmware Update"],"versions":[{"version":"0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"16cac6a8-cc1e-4741-89aa-6b97e2437706","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:C/RE:L/U:Red","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"USER","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"LOW","providerUrgency":"RED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:30:11.739848Z","id":"CVE-2026-75969","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"16cac6a8-cc1e-4741-89aa-6b97e2437706","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://psirt.havsys.com/","source":"16cac6a8-cc1e-4741-89aa-6b97e2437706"}]}},{"cve":{"id":"CVE-2026-100510","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:17:59.147","lastModified":"2026-09-30T19:04:41.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"BoldGrid","product":"Post and Page Builder by BoldGrid","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"post-and-page-builder","versions":[{"version":"n/a","lessThanOrEqual":"1.27.14","versionType":"custom","status":"affected","changes":[{"at":"1.27.15","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:57:44.977518Z","id":"CVE-2026-100510","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/post-and-page-builder/vulnerability/wordpress-post-and-page-builder-by-boldgrid-plugin-1-27-14-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-100512","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:17:59.300","lastModified":"2026-09-30T19:04:41.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Hook & Filter","product":"Nested Pages","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-nested-pages","versions":[{"version":"n/a","lessThanOrEqual":"3.3.2","versionType":"custom","status":"affected","changes":[{"at":"3.3.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:57:36.000465Z","id":"CVE-2026-100512","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-nested-pages/vulnerability/wordpress-nested-pages-plugin-3-3-2-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102375","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:18:14.040","lastModified":"2026-10-07T07:16:56.923","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole: from n/a through 4.2.14."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Optimole","product":"Optimole","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"optimole-wp","versions":[{"version":"0","lessThanOrEqual":"4.2.14","versionType":"custom","status":"affected","changes":[{"at":"4.2.15","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:57:25.365530Z","id":"CVE-2026-102375","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/optimole-wp/vulnerability/wordpress-optimole-plugin-4-2-14-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102376","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:18:14.197","lastModified":"2026-09-30T19:04:41.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPMU DEV","product":"Branda","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"branda-white-labeling","versions":[{"version":"n/a","lessThanOrEqual":"3.4.32","versionType":"custom","status":"affected","changes":[{"at":"3.4.33","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:57:16.851239Z","id":"CVE-2026-102376","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/branda-white-labeling/vulnerability/wordpress-branda-plugin-3-4-32-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102377","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:18:14.393","lastModified":"2026-09-30T19:04:41.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"10Web","product":"Photo Gallery by 10Web","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"photo-gallery","versions":[{"version":"n/a","lessThanOrEqual":"1.8.46","versionType":"custom","status":"affected","changes":[{"at":"1.8.47","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:57:08.614627Z","id":"CVE-2026-102377","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/photo-gallery/vulnerability/wordpress-photo-gallery-by-10web-plugin-1-8-46-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102391","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:18:14.567","lastModified":"2026-09-30T19:04:41.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"jetmonsters","product":"JetFormBuilder","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"jetformbuilder","versions":[{"version":"n/a","lessThanOrEqual":"3.6.5.4","versionType":"custom","status":"affected","changes":[{"at":"3.6.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:56:59.242262Z","id":"CVE-2026-102391","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-6-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102392","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:18:14.713","lastModified":"2026-09-30T19:04:41.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"ThemeHigh","product":"Extra Product Options For WooCommerce | Custom Product Addons and Fields","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-extra-product-options","versions":[{"version":"n/a","lessThanOrEqual":"3.3.8","versionType":"custom","status":"affected","changes":[{"at":"3.3.9","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:56:53.118920Z","id":"CVE-2026-102392","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-extra-product-options/vulnerability/wordpress-extra-product-options-for-woocommerce-custom-product-addons-and-fields-plugin-3-3-8-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102397","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:18:14.863","lastModified":"2026-09-30T19:04:41.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"supsystic","product":"Ultimate Maps by Supsystic","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ultimate-maps-by-supsystic","versions":[{"version":"n/a","lessThanOrEqual":"1.5.5","versionType":"custom","status":"affected","changes":[{"at":"1.6.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:58:37.217050Z","id":"CVE-2026-102397","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ultimate-maps-by-supsystic/vulnerability/wordpress-ultimate-maps-by-supsystic-plugin-1-5-5-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103399","sourceIdentifier":"secalert@redhat.com","published":"2026-09-30T18:18:16.137","lastModified":"2026-09-30T20:17:30.987","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup3","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libsoup","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:10:59.353028Z","id":"CVE-2026-103399","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-444"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-103399","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543949","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-103437","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T18:18:16.290","lastModified":"2026-09-30T21:17:08.583","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS.\n\nThis issue affects MediaWiki ReadingLists extension: 1.46 and 1.45."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki ReadingLists extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/ReadingLists","versions":[{"version":"1.46","status":"affected"},{"version":"1.45","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","baseScore":1.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:12:22.734768Z","id":"CVE-2026-103437","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I9a724c05b2a55845007512422362e02ed8cf44b0","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435863","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103438","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T18:18:16.440","lastModified":"2026-09-30T21:17:08.710","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS).\n\nThis issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki Wikistories extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/Wikistories","versions":[{"version":"1.46","status":"affected"},{"version":"1.45","status":"affected"},{"version":"1.43","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","baseScore":0.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:11:20.413981Z","id":"CVE-2026-103438","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/Iad1281879723eba73e4338a00d5ff35c6eed0c3e","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T182213","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103439","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T18:18:16.590","lastModified":"2026-09-30T21:17:08.833","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS).\n\nThis issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki Wikbase extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/Wikibase","versions":[{"version":"1.46","status":"affected"},{"version":"1.45","status":"affected"},{"version":"1.43","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","baseScore":0.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:12:13.696391Z","id":"CVE-2026-103439","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/Ie7a35b211565148e0cae437a4a8c41633b81f1b3","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T182213","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103440","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T18:18:16.727","lastModified":"2026-09-30T21:17:08.950","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation.\n\nThis issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki PageTriage extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/PageTriage","versions":[{"version":"1.46","status":"affected"},{"version":"1.45","status":"affected"},{"version":"1.43","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","baseScore":1.2,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:11:07.978060Z","id":"CVE-2026-103440","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-202"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I4bdd5f5be95ed5d02c504784fb31da4e5de59da6","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435623","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103445","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T18:18:16.877","lastModified":"2026-09-30T21:17:09.300","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS.\n\nThis issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki Page_Forms extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/PageForms","versions":[{"version":"1.46","status":"affected"},{"version":"1.45","status":"affected"},{"version":"1.43","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","baseScore":1.2,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:12:35.214725Z","id":"CVE-2026-103445","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I4ace525a1c1760ecdd1d770380606d9960d3e644","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435622","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103446","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T18:18:17.017","lastModified":"2026-10-06T19:17:39.550","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.\n\nThis issue affects MediaWiki WikiLambda extension: 1.46."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki WikiLambda extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/WikiLambda","versions":[{"version":"1.46","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:25:03.783560Z","id":"CVE-2026-103446","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/If2c05b109672fc65f63372f86c768859dc6639fd","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435086","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103471","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T18:18:17.163","lastModified":"2026-09-30T20:17:31.283","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Corvusoft","product":"restbed","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.0.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:17:48.617816Z","id":"CVE-2026-103471","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/Corvusoft/restbed","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/detail/service_impl.cpp#L554","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/session.cpp#L200","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Corvusoft/restbed/issues/558","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/restbed-through-5.0.0-denial-of-service-via-unbounded-header-buffering","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Corvusoft/restbed/issues/558","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103472","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T18:18:17.330","lastModified":"2026-10-01T19:17:18.083","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Corvusoft","product":"restbed","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.0.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T17:59:51.920409Z","id":"CVE-2026-103472","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/Corvusoft/restbed","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/detail/web_socket_impl.cpp#L117","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Corvusoft/restbed/issues/558","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/restbed-through-5.0.0-websocket-memory-exhaustion-via-unbounded-frame-buffering","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-103473","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T18:18:17.483","lastModified":"2026-10-02T17:17:02.680","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"denoland","product":"deno","defaultStatus":"unaffected","versions":[{"version":"2.7.0","lessThanOrEqual":"2.9.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:26:54.906211Z","id":"CVE-2026-103473","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/denoland/deno","source":"disclosure@vulncheck.com"},{"url":"https://github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1339","source":"disclosure@vulncheck.com"},{"url":"https://github.com/denoland/deno/blob/0c071246a412575e07423263404a5d13e7ed6aa2/ext/node/polyfills/internal/child_process.ts#L1499","source":"disclosure@vulncheck.com"},{"url":"https://github.com/denoland/deno/pull/36772","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/deno-2.7.0-through-2.9.7-command-injection-via-node-child-process","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-103474","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T18:18:17.647","lastModified":"2026-09-30T19:08:43.927","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"yii2-starter-kit","product":"yii2-starter-kit","defaultStatus":"unaffected","packageURL":"pkg:composer/yii2-starter-kit/yii2-starter-kit","versions":[{"version":"0","lessThanOrEqual":"4.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:44:26.126873Z","id":"CVE-2026-103474","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/yii-starter-kit/yii2-starter-kit","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/backend/modules/file/controllers/StorageController.php#L36","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/issues/797","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-unrestricted-file-upload-rce","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-103475","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T18:18:17.817","lastModified":"2026-09-30T20:17:31.447","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"yii2-starter-kit","product":"yii2-starter-kit","defaultStatus":"unaffected","packageURL":"pkg:composer/yii2-starter-kit/yii2-starter-kit","versions":[{"version":"0","lessThanOrEqual":"4.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:13:17.145317Z","id":"CVE-2026-103475","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-489"}]}],"references":[{"url":"https://github.com/yii-starter-kit/yii2-starter-kit","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/common/config/web.php#L21","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/issues/797","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-debug-and-gii-module-exposure","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-103476","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T18:18:17.973","lastModified":"2026-10-01T16:17:36.317","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without authentication or authorization checks."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"yii2-starter-kit","product":"yii2-starter-kit","defaultStatus":"unaffected","packageURL":"pkg:composer/yii2-starter-kit/yii2-starter-kit","versions":[{"version":"0","lessThanOrEqual":"4.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:33:56.622513Z","id":"CVE-2026-103476","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/yii-starter-kit/yii2-starter-kit","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/blob/cc2c451e8c959c7300b04efea597706a38609f58/frontend/controllers/ArticleController.php#L69","source":"disclosure@vulncheck.com"},{"url":"https://github.com/yii-starter-kit/yii2-starter-kit/issues/797","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/yii2-starter-kit-through-4.2.0-unauthorized-file-download-via-attachment-download","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-103500","sourceIdentifier":"security@mozilla.org","published":"2026-09-30T18:18:18.120","lastModified":"2026-10-16T19:17:01.550","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4."}],"affected":[{"source":"security@mozilla.org","affectedData":[{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"140.17","lessThanOrEqual":"140.*","versionType":"rpm","status":"unaffected"},{"version":"153.4","lessThanOrEqual":"153.*","versionType":"rpm","status":"unaffected"},{"version":"157","lessThanOrEqual":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-16T18:33:49.871087Z","id":"CVE-2026-103500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","versionEndExcluding":"140.17.0","matchCriteriaId":"D25C5E0F-CC93-48A0-A656-29450505E8C6"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","versionStartIncluding":"141.0","versionEndExcluding":"153.4.0","matchCriteriaId":"90E6FA6F-4AD3-4A75-A02F-5B668644087B"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","versionStartIncluding":"154.0","versionEndExcluding":"157.0","matchCriteriaId":"8A93E2FC-CEDC-4074-B587-70CD89C5BC2B"}]}]}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2070267","source":"security@mozilla.org","tags":["Permissions Required"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-101/","source":"security@mozilla.org","tags":["Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-102/","source":"security@mozilla.org","tags":["Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-103/","source":"security@mozilla.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-53605","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T18:18:37.213","lastModified":"2026-10-02T17:17:06.063","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"pollen-robotics","product":"reachy-mini-os","versions":[{"version":"< 0.2.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:25:03.898562Z","id":"CVE-2026-53605","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-250"},{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/pollen-robotics/reachy-mini-os/commit/cee4076f36bd95a2a6b894a56a48c7e971e75445","source":"security-advisories@github.com"},{"url":"https://github.com/pollen-robotics/reachy-mini-os/releases/tag/v0.2.4","source":"security-advisories@github.com"},{"url":"https://github.com/pollen-robotics/reachy-mini-os/security/advisories/GHSA-7rhg-9v48-x3h2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-55094","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T18:18:37.387","lastModified":"2026-09-30T20:17:32.590","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"taskcluster","product":"taskcluster","versions":[{"version":"< 100.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:12:04.595464Z","id":"CVE-2026-55094","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-95"},{"lang":"en","value":"CWE-250"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2045091","source":"security-advisories@github.com"},{"url":"https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f193b564e2334b","source":"security-advisories@github.com"},{"url":"https://github.com/taskcluster/taskcluster/issues/8716","source":"security-advisories@github.com"},{"url":"https://github.com/taskcluster/taskcluster/pull/8718","source":"security-advisories@github.com"},{"url":"https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2q38","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-55107","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T18:18:37.550","lastModified":"2026-09-30T20:17:32.923","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. This issue has been patched in version 0.9.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"elct9620","product":"kobako","versions":[{"version":">= 0.1.0, < 0.9.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:48:55.982496Z","id":"CVE-2026-55107","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-470"}]}],"references":[{"url":"https://github.com/elct9620/kobako/commit/64f84700c81f44902bed9211318d5362f44987b3","source":"security-advisories@github.com"},{"url":"https://github.com/elct9620/kobako/releases/tag/v0.9.1","source":"security-advisories@github.com"},{"url":"https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h","source":"security-advisories@github.com"},{"url":"https://github.com/elct9620/kobako/security/advisories/GHSA-7pwq-q9jf-539h","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-55224","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T18:18:37.713","lastModified":"2026-10-02T17:17:06.293","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands. This issue has been patched in version 3.2.0-alpha.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mineadmin","product":"MineAdmin","versions":[{"version":"< 3.2.0-alpha.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:27:53.095356Z","id":"CVE-2026-55224","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/mineadmin/MineAdmin/commit/ca41902a2a5422676227e5088f4cc1dec06044f1","source":"security-advisories@github.com"},{"url":"https://github.com/mineadmin/MineAdmin/pull/728","source":"security-advisories@github.com"},{"url":"https://github.com/mineadmin/MineAdmin/releases/tag/v3.2.0-alpha.2","source":"security-advisories@github.com"},{"url":"https://github.com/mineadmin/MineAdmin/security/advisories/GHSA-59xm-4m8c-g3xj","source":"security-advisories@github.com"},{"url":"https://github.com/mineadmin/MineAdmin/security/advisories/GHSA-59xm-4m8c-g3xj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-87004","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T18:18:41.470","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's token endpoint using jose.jwt.get_unverified_claims() instead of jwt.decode(). This skips signature verification, audience (aud) validation, issuer (iss) validation, and expiry (exp) checking entirely. The extracted claims (email/sub/preferred_username) are then used directly as the user_id for the resulting Tugtainer session. This issue has been patched in version 1.31.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Quenary","product":"tugtainer","versions":[{"version":"< 1.31.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T18:00:13.050961Z","id":"CVE-2026-87004","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/Quenary/tugtainer/commit/b55269b6a3bfd43b0f2f5bd5f137ee0c81b7c2e4","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/releases/tag/v1.31.3","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/security/advisories/GHSA-crjc-6vc7-xrfh","source":"security-advisories@github.com"},{"url":"https://github.com/Quenary/tugtainer/security/advisories/GHSA-crjc-6vc7-xrfh","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-94171","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:18:43.497","lastModified":"2026-10-05T14:17:21.483","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"VillaTheme","product":"CURCY","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-multi-currency","versions":[{"version":"0.0.0","lessThanOrEqual":"2.2.16","versionType":"custom","status":"affected","changes":[{"at":"2.2.17","status":"unaffected"}]},{"version":"2.2.18","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:58:29.042698Z","id":"CVE-2026-94171","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-multi-currency/vulnerability/wordpress-curcy-plugin-2-2-16-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97256","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:18:44.240","lastModified":"2026-09-30T19:04:41.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Greg – SiteOrigin","product":"Page Builder by SiteOrigin","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"siteorigin-panels","versions":[{"version":"n/a","lessThanOrEqual":"2.36.0","versionType":"custom","status":"affected","changes":[{"at":"2.36.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:58:23.446888Z","id":"CVE-2026-97256","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/siteorigin-panels/vulnerability/wordpress-page-builder-by-siteorigin-plugin-2-36-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97265","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:18:44.420","lastModified":"2026-09-30T19:04:41.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS.\n\nThis issue affects JetEngine: from n/a through 3.8.15.3."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Crocoblock. Jetimpex Inc.","product":"JetEngine","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"3.8.15.3","versionType":"custom","status":"affected","changes":[{"at":"3.8.15.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:58:09.046462Z","id":"CVE-2026-97265","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-15-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97290","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:18:44.590","lastModified":"2026-09-30T19:04:41.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Sayontan Sinha","product":"Photonic Gallery & Lightbox for Flickr, SmugMug & Others","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"photonic","versions":[{"version":"n/a","lessThanOrEqual":"3.36","versionType":"custom","status":"affected","changes":[{"at":"3.37","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:58:00.814577Z","id":"CVE-2026-97290","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/photonic/vulnerability/wordpress-photonic-gallery-lightbox-for-flickr-smugmug-others-plugin-3-36-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97291","sourceIdentifier":"audit@patchstack.com","published":"2026-09-30T18:18:44.763","lastModified":"2026-09-30T19:04:41.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Magazine3","product":"Schema & Structured Data for WP & AMP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"schema-and-structured-data-for-wp","versions":[{"version":"n/a","lessThanOrEqual":"1.66","versionType":"custom","status":"affected","changes":[{"at":"1.67","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T17:57:54.094501Z","id":"CVE-2026-97291","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/schema-and-structured-data-for-wp/vulnerability/wordpress-schema-structured-data-for-wp-amp-plugin-1-66-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-101879","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T20:17:18.373","lastModified":"2026-10-02T17:17:00.487","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get over the node WebSocket to silently capture screenshots, photograph users through webcams, and obtain device geolocation without user interaction."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw Windows Node","defaultStatus":"unaffected","repo":"https://github.com/openclaw/openclaw-windows-node","versions":[{"version":"0","lessThan":"2026.7.1-3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:28:56.691949Z","id":"CVE-2026-101879","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/openclaw/openclaw-windows-node/blob/v2026.7.1-2/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L1891-L1913","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/commit/16cb6897941fa7832ce2811e9d550caed9a49b4b","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/commit/31a8c6557df740232898079b21f0eb677a4119cf","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1-3","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-fxch-cgcp-4v5h","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-3-missing-authorization","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-fxch-cgcp-4v5h","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-101880","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T20:17:18.857","lastModified":"2026-10-01T02:20:29.877","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw Windows Node","defaultStatus":"unaffected","repo":"https://github.com/openclaw/openclaw-windows-node","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:33:47.048317Z","id":"CVE-2026-101880","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/ExecShellWrapperParser.cs#L253","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/commit/2077aa3e7159101bddcee2f4efcb9d604a81619e","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-r3x2-vf2f-vvj8","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-vg38-vjq2-vgvh","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-authorization-bypass","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-r3x2-vf2f-vvj8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-101881","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T20:17:19.330","lastModified":"2026-10-01T02:20:29.877","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause unbounded memory growth until the node process crashes."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw Windows Node","defaultStatus":"unaffected","repo":"https://github.com/openclaw/openclaw-windows-node","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:53:03.562709Z","id":"CVE-2026-101881","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/WebSocketClientBase.cs#L217-L263","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/commit/1810e357aa0d0639099b347f31c746ba7d31512a","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-xxr2-xm56-9cw5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-denial-of-service","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-xxr2-xm56-9cw5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-101882","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T20:17:19.790","lastModified":"2026-10-01T16:17:33.000","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through system.run without operator checks or user prompts."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw Windows Node","defaultStatus":"unaffected","repo":"https://github.com/openclaw/openclaw-windows-node","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:28:47.813494Z","id":"CVE-2026-101882","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/Capabilities/SystemCapability.cs#L791-L853","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/commit/8f07ad92beb28376bc228c0b07093173a043a656","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/commit/988df5badc84ab5efd5b4e291766a1fa5e7e268a","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-f32j-8759-w2fp","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-g95v-c9r6-2hmq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-remote-code-execution-via-system-execapprovals-set","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-f32j-8759-w2fp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-g95v-c9r6-2hmq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-101883","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T20:17:20.197","lastModified":"2026-10-02T17:17:00.647","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw Windows Node","defaultStatus":"unaffected","repo":"https://github.com/openclaw/openclaw-windows-node","versions":[{"version":"0","lessThanOrEqual":"2026.9.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:29:51.024334Z","id":"CVE-2026-101883","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Tray.WinUI/Windows/CanvasWindow.xaml.cs#L77-L109","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/blob/v2026.9.4/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L1244-L1270","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/commit/16528aadaa45d7bc6718b07ccf8b01f3eb033ad1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-7vch-pmw9-3g4q","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-windows-node-through-2026.9.4-ssrf-via-canvas-present","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-7vch-pmw9-3g4q","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-101884","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T20:17:20.663","lastModified":"2026-10-01T02:20:29.877","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or java to load attacker-controlled code and achieve arbitrary code execution."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OpenClaw","product":"OpenClaw Windows Node","defaultStatus":"unaffected","repo":"https://github.com/openclaw/openclaw-windows-node","versions":[{"version":"0","lessThan":"2026.7.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:33:07.973543Z","id":"CVE-2026-101884","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Shared/ExecEnvSanitizer.cs#L15-L50","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/commit/261ba11aaad671834ad141bb85101b50cf1a38f6","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-39cf-qcfw-g8pg","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-remote-code-execution-via-environment-override","source":"disclosure@vulncheck.com"},{"url":"https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-39cf-qcfw-g8pg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-101885","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T20:17:21.157","lastModified":"2026-10-01T02:20:29.877","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins directory, such as shell startup files, enabling code execution."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"zeroclaw-labs","product":"ZeroClaw","defaultStatus":"unaffected","repo":"https://github.com/zeroclaw-labs/zeroclaw","versions":[{"version":"0","lessThan":"0.8.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:54:26.896752Z","id":"CVE-2026-101885","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/zeroclaw-labs/zeroclaw/blob/v0.8.4/crates/zeroclaw-plugins/src/host.rs#L238-L273","source":"disclosure@vulncheck.com"},{"url":"https://github.com/zeroclaw-labs/zeroclaw/commit/432e034d3cb024610d5916a2f328678d151c1dd5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/zeroclaw-labs/zeroclaw/releases/tag/v0.8.5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/zeroclaw-labs/zeroclaw/security/advisories/GHSA-93f6-34w8-5g98","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/zeroclaw-before-0.8.5-path-traversal-via-plugin-manifest-wasm-path","source":"disclosure@vulncheck.com"},{"url":"https://github.com/zeroclaw-labs/zeroclaw/security/advisories/GHSA-93f6-34w8-5g98","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-102990","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T20:17:26.140","lastModified":"2026-09-30T21:17:06.307","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"patrickjuchli","product":"basic-ftp","versions":[{"version":"< 6.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T20:05:43.038485Z","id":"CVE-2026-102990","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9","source":"security-advisories@github.com"},{"url":"https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1","source":"security-advisories@github.com"},{"url":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","source":"security-advisories@github.com"},{"url":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-102991","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T20:17:26.547","lastModified":"2026-09-30T20:17:26.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpath to absorb the traversal segments before the leading dot-dot check, while posixpath resolution can escape the configured template directory. An application that passes attacker-controlled template names or include paths can disclose process-readable files on the same volume, and a targeted file containing Mako template syntax may also be parsed and executed as a template. Raw URL paths are generally normalized before reaching this form, but query strings, form or JSON bodies, route parameters, and dynamic include expressions can preserve it. This issue is fixed in version 1.4.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"sqlalchemy","product":"mako","versions":[{"version":"< 1.4.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:54:27.628844Z","id":"CVE-2026-102991","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/sqlalchemy/mako/commit/000ed85e4e48771eff460bf4fc721fb43de80e08","source":"security-advisories@github.com"},{"url":"https://github.com/sqlalchemy/mako/issues/441","source":"security-advisories@github.com"},{"url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_4_2","source":"security-advisories@github.com"},{"url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-5639-2j2p-m4mx","source":"security-advisories@github.com"},{"url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-5639-2j2p-m4mx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-102992","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T20:17:27.080","lastModified":"2026-09-30T21:17:06.450","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"piscinajs","product":"piscina","versions":[{"version":"< 4.9.4","status":"affected"},{"version":">= 5.0.0, < 5.3.2","status":"affected"},{"version":">= 6.0.0-rc.1, < 6.0.0-rc.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T20:47:28.974211Z","id":"CVE-2026-102992","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f","source":"security-advisories@github.com"},{"url":"https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72","source":"security-advisories@github.com"},{"url":"https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7","source":"security-advisories@github.com"},{"url":"https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6","source":"security-advisories@github.com"},{"url":"https://github.com/piscinajs/piscina/releases/tag/v4.9.4","source":"security-advisories@github.com"},{"url":"https://github.com/piscinajs/piscina/releases/tag/v5.3.2","source":"security-advisories@github.com"},{"url":"https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5","source":"security-advisories@github.com"},{"url":"https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx","source":"security-advisories@github.com"},{"url":"https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-102993","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T20:17:27.630","lastModified":"2026-10-02T17:17:01.203","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.17.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:31:55.843886Z","id":"CVE-2026-102993","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.17.0","matchCriteriaId":"3E52967B-572F-4CB5-A350-DDD0035B85E0"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/89db7c4fe9315ecc964bfdf05a4e8c4b94175163","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4047","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.17.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-qv6h-rv94-w285","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102994","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T20:17:28.080","lastModified":"2026-10-05T15:24:04.943","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T20:50:09.677694Z","id":"CVE-2026-102994","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.0","matchCriteriaId":"979884EA-605F-4E7C-AB90-ED57B7236E8C"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/82501d2993c6387833c4949d205caeb188f8bb9e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4055","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.18.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-5jq2-8x83-x246","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103387","sourceIdentifier":"cna@vuldb.com","published":"2026-09-30T20:17:30.620","lastModified":"2026-10-01T02:12:10.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"garycourt","product":"uri-js","cpes":["cpe:2.3:a:garycourt:uri-js:*:*:*:*:*:*:*:*"],"modules":["Mailto Header Handler"],"versions":[{"version":"4.4.0","status":"affected"},{"version":"4.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:54:52.854537Z","id":"CVE-2026-103387","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-248"}]}],"references":[{"url":"https://github.com/garycourt/uri-js/","source":"cna@vuldb.com"},{"url":"https://github.com/garycourt/uri-js/issues/103","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-103387","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/956810","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/412124","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/412124/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-103547","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T20:17:31.607","lastModified":"2026-10-01T15:07:27.747","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenBSD","product":"OpenBSD","defaultStatus":"unknown","repo":"https://github.com/openbsd/src","versions":[{"version":"7.8","lessThan":"errata 057","versionType":"custom","status":"affected"},{"version":"7.9","lessThan":"errata 021","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:55:41.738525Z","id":"CVE-2026-103547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.9/common/021_ldapd.patch.sig","source":"cve@mitre.org"},{"url":"https://github.com/openbsd/src/commit/4f3f58e83c2a6d239c544236a9d4d76c74bbf960","source":"cve@mitre.org"},{"url":"https://www.openbsd.org/errata78.html","source":"cve@mitre.org"},{"url":"https://www.openbsd.org/errata79.html","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-103548","sourceIdentifier":"psirt@paloaltonetworks.com","published":"2026-09-30T20:17:31.957","lastModified":"2026-10-01T12:41:25.413","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user."}],"affected":[{"source":"psirt@paloaltonetworks.com","affectedData":[{"vendor":"Itron","product":"MV-90 xi","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@paloaltonetworks.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:56:02.841585Z","id":"CVE-2026-103548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@paloaltonetworks.com","type":"Secondary","description":[{"lang":"en","value":"CWE-257"},{"lang":"en","value":"CWE-260"},{"lang":"en","value":"CWE-261"}]}],"references":[{"url":"https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/commits/main/2026/PANW-2026-0002/PANW-2026-0002.md","source":"psirt@paloaltonetworks.com"}]}},{"cve":{"id":"CVE-2023-54402","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T21:16:51.980","lastModified":"2026-10-05T16:17:00.973","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value (testtoken) to bypass authentication. Attackers can exploit the unrestricted URL scheme handling, including file:// URIs, to read arbitrary local files such as operating-system and application configuration files, and to reach internal network hosts and services not otherwise accessible. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-26."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"iDocView","product":"iDocView","defaultStatus":"unaffected","versions":[{"version":"*","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:50:08.348106Z","id":"CVE-2023-54402","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://blog.csdn.net/qq_41904294/article/details/134995343","source":"disclosure@vulncheck.com"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/idoc/idocview-lfi.yaml","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/idocview-ssrf-via-doc-upload-endpoint-hardcoded-token","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2023-54403","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T21:16:52.150","lastModified":"2026-10-02T17:16:59.277","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this flaw to read sensitive files outside the web application directory, including configuration files containing database or service credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Yonyou","product":"U8 CRM","defaultStatus":"unaffected","versions":[{"version":"18","versionType":"custom","status":"unaffected"},{"version":"16.5","versionType":"custom","status":"unaffected"},{"version":"16.1","versionType":"custom","status":"affected"},{"version":"16.0","versionType":"custom","status":"affected"},{"version":"15.1","versionType":"custom","status":"affected"},{"version":"13","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:34:31.981215Z","id":"CVE-2023-54403","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20U8%20CRM%E5%AE%A2%E6%88%B7%E5%85%B3%E7%B3%BB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20getemaildata.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md","source":"disclosure@vulncheck.com"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/yonyou/yonyou-u8-crm-lfi.yaml","source":"disclosure@vulncheck.com"},{"url":"https://security.yonyou.com/#/noticeInfo?id=624","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/yonyou-u8-crm-arbitrary-file-read-via-getemaildata-php","source":"disclosure@vulncheck.com"},{"url":"https://www.yonyou.com/Global/","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2024-58387","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T21:16:52.510","lastModified":"2026-10-01T19:17:15.250","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as /api/model_report/file/download?index=/&ext=<path> to traverse the filesystem and disclose sensitive files including /etc/passwd, application database files, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-04 ."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Inspur","product":"Haiyue HCM Cloud","defaultStatus":"unaffected","versions":[{"version":"*","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:51:55.606778Z","id":"CVE-2024-58387","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://cn-sec.com/archives/3372984.html","source":"disclosure@vulncheck.com"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/hcm/hcm-cloud-lfi.yaml","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/inspur-hcm-cloud-arbitrary-file-read-via-file-download-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-101276","sourceIdentifier":"98a01053-8a31-4f6d-9aa9-252be161adc6","published":"2026-09-30T21:16:54.913","lastModified":"2026-10-01T16:17:32.020","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperf_stream; fixed in 3.22."}],"affected":[{"source":"98a01053-8a31-4f6d-9aa9-252be161adc6","affectedData":[{"vendor":"esnet","product":"iperf3","defaultStatus":"unaffected","versions":[{"version":"3.21","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"98a01053-8a31-4f6d-9aa9-252be161adc6","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:50:45.814450Z","id":"CVE-2026-101276","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"98a01053-8a31-4f6d-9aa9-252be161adc6","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://newreleases.io/project/github/esnet/iperf/release/3.22","source":"98a01053-8a31-4f6d-9aa9-252be161adc6"}]}},{"cve":{"id":"CVE-2026-102089","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:55.350","lastModified":"2026-10-08T13:42:51.950","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:29:22.647132Z","id":"CVE-2026-102089","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-p853-p65q-2vc8","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102090","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:55.490","lastModified":"2026-10-07T13:15:27.110","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:28:57.914403Z","id":"CVE-2026-102090","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-g3hj-598g-338g","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102091","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:55.617","lastModified":"2026-10-08T13:42:55.403","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Secure Data Forms","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:28:51.922295Z","id":"CVE-2026-102091","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m8mj-m4fv-jmrh","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102092","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:55.743","lastModified":"2026-10-07T13:21:51.160","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:14:25.278439Z","id":"CVE-2026-102092","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mhw9-vrqq-m434","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102093","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:55.870","lastModified":"2026-10-07T13:22:21.773","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:13:38.788522Z","id":"CVE-2026-102093","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mq6c-p42h-75j5","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102094","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:55.990","lastModified":"2026-10-08T13:42:59.037","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentially in the context of the mail-gateway service account."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:25:06.751129Z","id":"CVE-2026-102094","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-470"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9f5q-3c34-cpg8","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102095","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:56.120","lastModified":"2026-10-08T13:43:03.540","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:27:02.423931Z","id":"CVE-2026-102095","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-f252-4w8q-g74g","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102096","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:56.243","lastModified":"2026-10-07T13:22:54.733","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary operating-system commands, potentially with elevated privileges, on the affected appliance."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:25:21.474479Z","id":"CVE-2026-102096","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-c3wx-5mx6-2qpg","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102097","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:56.370","lastModified":"2026-10-08T13:43:06.717","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could potentially allow arbitrary commands to be executed on the affected gateway."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:25:27.090508Z","id":"CVE-2026-102097","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-465g-wpvm-8qmr","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102098","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:56.500","lastModified":"2026-10-07T13:23:42.013","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service. Exploitation requires an existing, authenticated administrative account with access to the affected reporting function."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:29:10.368464Z","id":"CVE-2026-102098","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-cqg3-857q-cqj6","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102099","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:56.630","lastModified":"2026-10-07T13:24:18.030","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks administrative export feature could allow an authenticated administrator to write a file to an arbitrary location on the underlying host, potentially leading to command execution on the appliance. Exploitation requires an existing, authenticated administrative account with access to the affected export function."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:25:13.923354Z","id":"CVE-2026-102099","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qj2g-2wfr-wg43","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102100","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:56.750","lastModified":"2026-10-07T16:17:32.143","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:09:13.199231Z","id":"CVE-2026-102100","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vr65-9jwc-jgjx","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102101","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:56.880","lastModified":"2026-10-07T13:25:15.543","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first being able to influence the affected data, so this issue is not exploitable on its own."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:26:31.492719Z","id":"CVE-2026-102101","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-x5hx-fgrp-prvf","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102102","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:57.000","lastModified":"2026-10-08T13:43:10.053","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves an issuer certificate in an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:23:46.653352Z","id":"CVE-2026-102102","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-jxv9-v53f-c79m","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102103","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:57.127","lastModified":"2026-10-08T13:43:14.650","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves a certificate revocation list in an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:22:45.904134Z","id":"CVE-2026-102103","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-p435-6c3j-4gh5","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102104","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:57.250","lastModified":"2026-10-08T13:43:18.307","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway performs an online certificate status check for an inbound message. Depending on the services reachable from the gateway, this could disclose sensitive internal information or disrupt gateway operation."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:21:53.782057Z","id":"CVE-2026-102104","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mqw3-m87w-4fx4","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102105","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:57.370","lastModified":"2026-10-08T13:43:21.870","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway renders message content that references external resources. Depending on the services reachable from the gateway, this could disclose sensitive internal information or trigger unintended actions on internal systems."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:13:49.786120Z","id":"CVE-2026-102105","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-hq47-4whq-9hgv","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102106","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:57.490","lastModified":"2026-10-08T13:43:25.367","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, modify, or delete internal users and managed domains and change their security-feature configuration without authenticating; deleting a managed domain also removes its user accounts and could lock administrators out of the gateway."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:14:06.115234Z","id":"CVE-2026-102106","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wwv8-qhqg-4q76","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102107","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:57.613","lastModified":"2026-10-07T13:55:07.470","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was authorized to act as the specified account. This could be used to solicit files or information from a recipient under a trusted identity; exploitation requires the feature to be enabled for the attacker's profile and the targeted recipient to act on the request."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:14:49.637826Z","id":"CVE-2026-102107","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wv69-6ghf-h3c4","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102108","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:57.737","lastModified":"2026-10-08T13:43:31.470","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account. Exploitation requires an administrator account holding a specific queue-management privilege."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:15:02.979511Z","id":"CVE-2026-102108","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-837h-99j2-hxjr","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102109","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:57.860","lastModified":"2026-10-08T13:43:34.577","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature is in use."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Secure Data Forms","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:15:10.794362Z","id":"CVE-2026-102109","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vw4g-v5qc-vv58","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102110","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:57.990","lastModified":"2026-10-13T12:01:07.347","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disrupt setup and leave the appliance in an incompletely configured state. The issue is only reachable while an appliance is being activated for the first time and not yet fully configured."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:19:49.178577Z","id":"CVE-2026-102110","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-670"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qfqh-c638-m5pg","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102111","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:58.137","lastModified":"2026-10-07T13:55:45.133","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative interface and audit log, allowing it to be silently rendered ineffective."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:19:56.545564Z","id":"CVE-2026-102111","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-1284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-4r97-hch3-g2f9","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102112","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:58.267","lastModified":"2026-10-07T13:56:12.303","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest privileges. Exploitation requires existing local access to that service account."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:20:19.156694Z","id":"CVE-2026-102112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-658c-86vw-g9hf","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102113","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:58.427","lastModified":"2026-10-07T13:56:33.520","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root. A privileged routine did not safely handle a filesystem path that the lower-privileged account could influence, allowing the attacker to cause a root-owned operation to run arbitrary commands with the highest privileges. Exploitation requires existing local access to that service account."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:21:18.422456Z","id":"CVE-2026-102113","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gwj7-wxrr-28v5","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102114","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:58.880","lastModified":"2026-10-07T13:57:03.907","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:21:28.814581Z","id":"CVE-2026-102114","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-p5q5-49j9-hx8w","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102115","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:59.180","lastModified":"2026-10-07T13:57:31.147","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:27:29.042797Z","id":"CVE-2026-102115","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-640"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102116","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:59.360","lastModified":"2026-10-08T13:43:37.370","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:27:41.210485Z","id":"CVE-2026-102116","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-91"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-pf8p-p269-4mjv","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102117","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:59.533","lastModified":"2026-10-13T12:00:38.113","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could then have operating-system commands executed on the node and receive their output, potentially resulting in remote code execution with the privileges of a local service account."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:27:48.586393Z","id":"CVE-2026-102117","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-807"},{"lang":"en","value":"CWE-940"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5rhv-f48q-gq5v","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102118","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:59.707","lastModified":"2026-10-07T13:58:08.037","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:28:00.930468Z","id":"CVE-2026-102118","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-250"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-8pmh-222g-6j48","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102119","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:16:59.900","lastModified":"2026-10-13T12:00:17.210","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:28:08.358537Z","id":"CVE-2026-102119","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-3r3r-hp4c-pxmh","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102120","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:00.057","lastModified":"2026-10-07T13:58:34.207","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in an internal cluster management function let attacker-supplied values reach a privileged execution context; exploitation requires existing access to a node in the cluster, and the affected function is not reachable from outside the cluster."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:21:40.646498Z","id":"CVE-2026-102120","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m968-434m-rgwp","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102121","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:00.213","lastModified":"2026-10-08T13:43:41.547","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve the form owner's Kiteworks account profile, including personal details, along with parts of the deployment's configuration settings; no passwords, authentication tokens, or multi-factor secrets were exposed."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Secure Data Forms","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:22:08.236569Z","id":"CVE-2026-102121","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-hf68-855j-745c","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102122","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:00.370","lastModified":"2026-10-07T14:03:35.687","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager role on a folder could grant the Owner role to themselves or to other members of that folder."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:22:14.484755Z","id":"CVE-2026-102122","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-7436-q3x6-cqxq","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102123","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:00.517","lastModified":"2026-10-07T14:08:29.467","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering it unavailable until an operator intervenes. Exploitation requires network access to the affected interface, which is not reachable on a fully configured appliance in its default configuration; reaching it depends on either the transient window while an appliance is first being provisioned or a non-default appliance configuration."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:22:21.562397Z","id":"CVE-2026-102123","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vcx7-3759-27xm","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102124","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:00.677","lastModified":"2026-10-08T13:43:47.497","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured during initial configuration."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:22:53.082519Z","id":"CVE-2026-102124","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-670"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q85p-q4v6-7w6f","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102125","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:00.813","lastModified":"2026-10-08T13:43:51.957","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could allow an attacker in that position to read or modify application data and configuration, or to disrupt the service on the affected appliance."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:23:07.249739Z","id":"CVE-2026-102125","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-653"},{"lang":"en","value":"CWE-668"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-58j2-hj9r-c258","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102126","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:00.963","lastModified":"2026-10-07T14:10:17.597","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected page. This could have permitted the lower-privileged administrator to escalate to full administrative control of the tenant, including the creation of a new administrative account."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:24:15.630566Z","id":"CVE-2026-102126","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-ccfx-6hq4-fx4g","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102127","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:01.117","lastModified":"2026-10-08T13:43:55.813","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service account, including cryptographic key material and credentials, and have them sent to a destination they control."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:23:31.130759Z","id":"CVE-2026-102127","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-9jwc-h943-6f84","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102128","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:01.270","lastModified":"2026-10-08T13:44:09.977","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a user it had not authenticated, and to provision a platform account for an identity it did not already know. A remote, unauthenticated sender could potentially exploit this to obtain control of a platform account."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:28:15.954252Z","id":"CVE-2026-102128","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qjvp-25r3-rgx6","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102129","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:01.407","lastModified":"2026-10-08T13:44:24.597","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:28:22.003260Z","id":"CVE-2026-102129","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-4gcf-w86v-34rp","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102130","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:01.533","lastModified":"2026-10-08T13:44:29.007","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service account."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:28:30.859854Z","id":"CVE-2026-102130","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m92m-q8cf-rcch","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102131","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:01.667","lastModified":"2026-10-08T13:44:35.413","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and executed, resulting in code execution as the gateway service account."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.0","versionType":"custom","status":"affected"},{"version":"9.5.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:28:37.169970Z","id":"CVE-2026-102131","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-178"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.0","matchCriteriaId":"2B7F84D9-5921-4C79-9B9D-628CC0EB3665"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-62f6-c955-4fhq","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102132","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:01.787","lastModified":"2026-10-07T14:09:53.413","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system administrator privileges, without any action by an existing system administrator."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:28:44.870292Z","id":"CVE-2026-102132","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qx8c-x3hv-c25g","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102133","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:01.910","lastModified":"2026-10-08T13:45:08.163","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned by the service account running the connector, enabling code execution in that account's context; exploitation additionally requires network egress from the appliance to a system under the attacker's control."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:23:37.406475Z","id":"CVE-2026-102133","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-53qp-jmrc-2g5j","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102134","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:02.030","lastModified":"2026-10-07T14:09:28.097","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:23:56.398419Z","id":"CVE-2026-102134","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-420"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-8q58-vrwm-jxhq","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102135","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:02.157","lastModified":"2026-10-08T13:45:13.707","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of a trusted cluster peer or administrative access to the appliance."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:24:05.305556Z","id":"CVE-2026-102135","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vmwr-r5xq-hp49","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102136","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:02.277","lastModified":"2026-10-13T11:59:53.180","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.0,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:24:21.585395Z","id":"CVE-2026-102136","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-93"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rpxx-jm93-w5j7","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102137","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:02.423","lastModified":"2026-10-13T11:59:30.617","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":0.7,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:24:38.606633Z","id":"CVE-2026-102137","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m6cv-4pjv-7435","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102138","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:02.543","lastModified":"2026-10-13T11:59:09.913","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:26:39.154554Z","id":"CVE-2026-102138","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q9w9-c5hj-87jm","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102139","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:02.663","lastModified":"2026-10-07T15:01:35.230","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of packages they neither sent nor received."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:26:22.762488Z","id":"CVE-2026-102139","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-fp46-xhg8-vpgm","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102140","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:02.783","lastModified":"2026-10-13T11:58:28.530","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the integrity of the imported data."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:26:16.635969Z","id":"CVE-2026-102140","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wfxj-p5jc-jqjw","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102141","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:02.903","lastModified":"2026-10-07T16:17:32.293","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a pending software patch present on the target node."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":0.8,"impactScore":5.3}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:09:49.121447Z","id":"CVE-2026-102141","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-m39v-w8fv-gf3m","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102142","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:03.027","lastModified":"2026-10-07T15:02:00.297","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance when the notification was next sent."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:14:11.835510Z","id":"CVE-2026-102142","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-1336"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gmgg-7xhc-75f9","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102143","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:03.143","lastModified":"2026-10-13T11:58:04.543","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate vulnerability to place the file in an executable location."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:14:03.743686Z","id":"CVE-2026-102143","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-434"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-3p9g-jh62-8f89","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102144","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:03.267","lastModified":"2026-10-07T15:02:03.253","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of service."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:13:46.705293Z","id":"CVE-2026-102144","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wwhf-5862-rjxq","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102145","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:03.390","lastModified":"2026-10-13T11:57:40.580","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:25:32.312235Z","id":"CVE-2026-102145","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-93"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-h97r-j99c-q8xc","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102146","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:03.510","lastModified":"2026-10-13T11:57:18.230","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could be used to alter application files and configuration or to disrupt the availability of the service."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:25:37.802471Z","id":"CVE-2026-102146","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-5pgq-v8g2-rg2f","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102147","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:03.633","lastModified":"2026-10-07T15:02:06.033","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Core","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:26:51.123845Z","id":"CVE-2026-102147","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xgh2-fgj6-w93r","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102149","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:03.760","lastModified":"2026-10-07T15:02:08.747","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where certificate-based login is enabled, potentially permitting unauthorized access to the account."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Email Protection Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:25:55.510552Z","id":"CVE-2026-102149","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionEndExcluding":"9.5.1","matchCriteriaId":"E3DAD823-F1FD-402B-86A5-C69DD8261D4B"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-c9w5-4frw-7wqq","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102150","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-30T21:17:03.880","lastModified":"2026-10-07T13:56:02.393","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form submissions."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Kiteworks","product":"Secure Data Forms","defaultStatus":"unknown","versions":[{"version":"9.3.0","lessThan":"9.5.1","versionType":"custom","status":"affected"},{"version":"9.5.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T13:26:09.262486Z","id":"CVE-2026-102150","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*","versionStartIncluding":"9.3.0","versionEndExcluding":"9.5.1","matchCriteriaId":"64B8D868-35C5-4AC9-B4EE-2EEF83D29FEA"}]}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vwvw-rp3m-rm37","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Vendor Advisory"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-102995","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:06.713","lastModified":"2026-10-05T15:23:15.717","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second follow-up to earlier /ToUnicode resource-consumption fixes and is limited to the remaining token-length path. This issue is fixed in version 6.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:50:23.022437Z","id":"CVE-2026-102995","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.1","matchCriteriaId":"8225DF7C-CA99-4AF9-B13B-EBC86DD40BDF"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/319d0b823ce2c311a2435e9fd93c13994d32bb51","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4071","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-fp3h-c4fm-7vvf","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102996","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:06.863","lastModified":"2026-10-05T15:13:17.070","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T20:48:29.732492Z","id":"CVE-2026-102996","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.1","matchCriteriaId":"8225DF7C-CA99-4AF9-B13B-EBC86DD40BDF"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/0fb26eb8cdd01c44b3b2c9fe8329751be2f7cfd5","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4072","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9cg-prrw-2r8q","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102997","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:07.020","lastModified":"2026-10-05T15:07:04.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:33:22.595789Z","id":"CVE-2026-102997","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.1","matchCriteriaId":"8225DF7C-CA99-4AF9-B13B-EBC86DD40BDF"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/d9d38cf99b115deb562d3b68f36c33027bc04f79","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4073","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-jw7q-gvrg-4vj3","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102998","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:07.177","lastModified":"2026-10-05T15:05:55.850","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.19.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T20:49:24.715485Z","id":"CVE-2026-102998","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.0","matchCriteriaId":"7F216921-F7CD-4900-9B87-1F4B98CCD341"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/959467a9b95be83e2dc5ae873ece5f371263ede7","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4087","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.19.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-php9-fj8v-98fj","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-102999","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:07.343","lastModified":"2026-10-05T15:04:55.217","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.19.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:51:12.395176Z","id":"CVE-2026-102999","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.0","matchCriteriaId":"7F216921-F7CD-4900-9B87-1F4B98CCD341"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/6b10556d13609a68f9ed18bb29fdd8bba88eb2c3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4081","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.19.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-v247-6f48-mgcj","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-103000","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T21:17:07.490","lastModified":"2026-10-05T15:03:11.473","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and potentially making the application unavailable. This issue is fixed in version 6.19.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"py-pdf","product":"pypdf","versions":[{"version":"< 6.19.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T20:49:14.062135Z","id":"CVE-2026-103000","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pypdf_project:pypdf:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.0","matchCriteriaId":"7F216921-F7CD-4900-9B87-1F4B98CCD341"}]}]}],"references":[{"url":"https://github.com/py-pdf/pypdf/commit/0d8b5a8832cde1ba308b5c27567b879b7b7eed4a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/py-pdf/pypdf/pull/4096","source":"security-advisories@github.com","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/py-pdf/pypdf/releases/tag/6.19.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/py-pdf/pypdf/security/advisories/GHSA-w23x-9jrw-r45c","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-51568","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:10.993","lastModified":"2026-10-01T17:17:25.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T16:11:16.135903Z","id":"CVE-2026-51568","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/6f26878766be5712ed504857c54492d7","source":"cve@mitre.org"},{"url":"https://github.com/agentscope-ai/agentscope/issues/1508","source":"cve@mitre.org"},{"url":"https://github.com/agentscope-ai/agentscope/issues/1508","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51570","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:11.137","lastModified":"2026-10-02T13:17:45.303","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:33:11.203941Z","id":"CVE-2026-51570","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/c6a6857348472db85895b346ba818195","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51852","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:11.273","lastModified":"2026-10-07T16:17:48.410","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:47:13.233342Z","id":"CVE-2026-51852","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/13af0869833757245685d2d390458664","source":"cve@mitre.org"},{"url":"https://github.com/agent0ai/agent-zero/issues/1540","source":"cve@mitre.org"},{"url":"https://gist.github.com/Ro1ME/13af0869833757245685d2d390458664","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/agent0ai/agent-zero/issues/1540","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51853","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:11.400","lastModified":"2026-10-01T19:17:20.613","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:49:42.875134Z","id":"CVE-2026-51853","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/4fe09fc7f94c9c0b10c8b6198a70e920","source":"cve@mitre.org"},{"url":"https://github.com/agent0ai/agent-zero/issues/1539","source":"cve@mitre.org"},{"url":"https://github.com/agent0ai/agent-zero/issues/1539","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51856","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:11.520","lastModified":"2026-10-01T17:17:25.740","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T16:08:56.059920Z","id":"CVE-2026-51856","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/c383f66d1fd6de40b6693f9b6cc181e7","source":"cve@mitre.org"},{"url":"https://github.com/agentscope-ai/agentscope/issues/1563","source":"cve@mitre.org"},{"url":"https://gist.github.com/Ro1ME/c383f66d1fd6de40b6693f9b6cc181e7","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51857","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:11.647","lastModified":"2026-10-02T13:17:46.300","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:34:32.208189Z","id":"CVE-2026-51857","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/78606e0763520d6519897e90b305d3cd","source":"cve@mitre.org"},{"url":"https://github.com/camel-ai/camel/issues/4037","source":"cve@mitre.org"},{"url":"https://github.com/camel-ai/camel/issues/4037","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51858","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:11.777","lastModified":"2026-10-02T20:17:02.550","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T19:17:34.097988Z","id":"CVE-2026-51858","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/1efc7b63bded3e4d39c54ff7b0caedf4","source":"cve@mitre.org"},{"url":"https://github.com/camel-ai/camel/issues/4038","source":"cve@mitre.org"},{"url":"https://github.com/camel-ai/camel/issues/4038","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51859","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:11.893","lastModified":"2026-10-01T19:17:20.790","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:47:35.734560Z","id":"CVE-2026-51859","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/df160925a60dd917550f7c87bfe62519","source":"cve@mitre.org"},{"url":"https://github.com/dataelement/bisheng/issues/1994","source":"cve@mitre.org"},{"url":"https://github.com/dataelement/bisheng/issues/1994","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51860","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:12.013","lastModified":"2026-10-01T17:17:25.910","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T16:06:46.711978Z","id":"CVE-2026-51860","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/e4129afdd9af2ff1bdcecf27ec5098cf","source":"cve@mitre.org"},{"url":"https://github.com/dataelement/bisheng/issues/1994","source":"cve@mitre.org"},{"url":"https://gist.github.com/Ro1ME/e4129afdd9af2ff1bdcecf27ec5098cf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51861","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:12.127","lastModified":"2026-10-02T13:17:47.340","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:36:33.369636Z","id":"CVE-2026-51861","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/a03814bf661b36823c3ef5e32af93298","source":"cve@mitre.org"},{"url":"https://github.com/dataelement/bisheng/issues/1995","source":"cve@mitre.org"},{"url":"https://github.com/dataelement/bisheng/issues/1995","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51862","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:12.243","lastModified":"2026-10-07T16:17:48.607","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:09:54.073254Z","id":"CVE-2026-51862","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/c09e6aca2e9c7280ca4fabb1f44dcd2a","source":"cve@mitre.org"},{"url":"https://github.com/eosphoros-ai/DB-GPT/issues/3026","source":"cve@mitre.org"},{"url":"https://gist.github.com/Ro1ME/c09e6aca2e9c7280ca4fabb1f44dcd2a","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/eosphoros-ai/DB-GPT/issues/3026","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51864","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:12.370","lastModified":"2026-10-01T19:17:20.977","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:41:29.891721Z","id":"CVE-2026-51864","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/164a2aff1229df650a5bcc2a039900c5","source":"cve@mitre.org"},{"url":"https://github.com/eosphoros-ai/DB-GPT/issues/3027","source":"cve@mitre.org"},{"url":"https://github.com/eosphoros-ai/DB-GPT/issues/3027","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51866","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:12.483","lastModified":"2026-10-01T17:17:26.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T16:05:20.655629Z","id":"CVE-2026-51866","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/f8f5b730a4000684d3a92a67f82ee03c","source":"cve@mitre.org"},{"url":"https://github.com/eosphoros-ai/DB-GPT/issues/3047","source":"cve@mitre.org"},{"url":"https://gist.github.com/Ro1ME/f8f5b730a4000684d3a92a67f82ee03c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51867","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:12.600","lastModified":"2026-10-02T13:17:48.443","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:38:29.024858Z","id":"CVE-2026-51867","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/62547f81c244f273b66755dad63a8673","source":"cve@mitre.org"},{"url":"https://gist.github.com/Ro1ME/62547f81c244f273b66755dad63a8673","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51869","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:12.717","lastModified":"2026-10-07T16:17:48.803","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T15:14:27.000517Z","id":"CVE-2026-51869","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/884fbbd589998b81fa05c20ac205569f","source":"cve@mitre.org"},{"url":"https://github.com/eosphoros-ai/DB-GPT/issues/3082","source":"cve@mitre.org"},{"url":"https://github.com/eosphoros-ai/DB-GPT/issues/3082","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51870","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:12.833","lastModified":"2026-10-01T19:17:21.150","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:37:41.118487Z","id":"CVE-2026-51870","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/58b7e7523f517bc1241183ff988b6707","source":"cve@mitre.org"},{"url":"https://github.com/HKUDS/DeepTutor/issues/506","source":"cve@mitre.org"},{"url":"https://github.com/HKUDS/DeepTutor/issues/506","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51871","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:12.947","lastModified":"2026-10-01T17:17:26.300","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T16:04:13.015730Z","id":"CVE-2026-51871","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/3067a5bd69dcd35ffc98dc41ca611242","source":"cve@mitre.org"},{"url":"https://github.com/stitionai/devika/issues/714","source":"cve@mitre.org"},{"url":"https://gist.github.com/Ro1ME/3067a5bd69dcd35ffc98dc41ca611242","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-51872","sourceIdentifier":"cve@mitre.org","published":"2026-09-30T21:17:13.067","lastModified":"2026-10-02T13:17:49.467","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T12:40:38.403018Z","id":"CVE-2026-51872","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://gist.github.com/Ro1ME/e65de4e8107334a75dcc241c73ffdfb1","source":"cve@mitre.org"},{"url":"https://github.com/stitionai/devika/issues/715","source":"cve@mitre.org"},{"url":"https://github.com/stitionai/devika/issues/715","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-92172","sourceIdentifier":"cve-assign@fb.com","published":"2026-09-30T21:17:17.100","lastModified":"2026-10-01T17:17:33.150","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication."}],"affected":[{"source":"cve-assign@fb.com","affectedData":[{"vendor":"Meta Platforms, Inc","product":"Meta Horizon OS","defaultStatus":"unaffected","versions":[{"version":"v0.0.0.0.0","lessThan":"v66.0.0.733.524","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T16:13:46.690975Z","id":"CVE-2026-92172","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-923"}]}],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2026-92172","source":"cve-assign@fb.com"}]}},{"cve":{"id":"CVE-2026-92173","sourceIdentifier":"cve-assign@fb.com","published":"2026-09-30T21:17:17.207","lastModified":"2026-10-01T19:17:25.630","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication."}],"affected":[{"source":"cve-assign@fb.com","affectedData":[{"vendor":"Meta Platforms, Inc","product":"Meta Horizon OS","defaultStatus":"unaffected","versions":[{"version":"v0.0.0.0.0","lessThan":"v74.0.0.878.1682","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:54:54.274370Z","id":"CVE-2026-92173","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-923"}]}],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2026-92173","source":"cve-assign@fb.com"}]}},{"cve":{"id":"CVE-2026-101283","sourceIdentifier":"98a01053-8a31-4f6d-9aa9-252be161adc6","published":"2026-09-30T22:16:33.317","lastModified":"2026-10-01T16:17:32.460","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the heap via an oversized authtoken; fixed in 3.22"}],"affected":[{"source":"98a01053-8a31-4f6d-9aa9-252be161adc6","affectedData":[{"vendor":"esnet","product":"iperf3","defaultStatus":"unaffected","versions":[{"version":"3.20","status":"affected"},{"version":"3.21","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"98a01053-8a31-4f6d-9aa9-252be161adc6","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:51:25.364045Z","id":"CVE-2026-101283","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"98a01053-8a31-4f6d-9aa9-252be161adc6","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://newreleases.io/project/github/esnet/iperf/release/3.22","source":"98a01053-8a31-4f6d-9aa9-252be161adc6"}]}},{"cve":{"id":"CVE-2026-103001","sourceIdentifier":"security-advisories@github.com","published":"2026-09-30T22:16:33.537","lastModified":"2026-10-08T13:13:53.857","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"jpadilla","product":"pyjwt","versions":[{"version":">= 2.11.0, <= 2.13.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T23:47:10.360725Z","id":"CVE-2026-103001","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-471"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*","versionStartIncluding":"2.11.0","versionEndExcluding":"2.13.0","matchCriteriaId":"80AC54CF-EFA4-4243-B7EF-7FC70BFF0246"}]}]}],"references":[{"url":"https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/jpadilla/pyjwt/issues/679","source":"security-advisories@github.com","tags":["Exploit","Issue Tracking"]},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-47096","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T22:16:33.720","lastModified":"2026-10-01T15:17:29.927","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamID_SystemName value through the /config?action=set web configuration API. Attackers can exploit this flaw when device authentication is disabled to persistently execute arbitrary script in the browser of any administrator who opens the web management interface, enabling theft of stored secrets such as web UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials, as well as hijacking of the authenticated session."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"AJA Video Systems","product":"HELO Plus","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.1.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T14:26:29.454696Z","id":"CVE-2026-47096","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://d26ddnfpy9hzf8.cloudfront.net/aja-web/public/pdf/2026/AJA_HELO_PLUS_ReleaseNotes_v2.1.7.pdf","source":"disclosure@vulncheck.com"},{"url":"https://www.aja.com/security-advisories/aja-sa-2026-003","source":"disclosure@vulncheck.com"},{"url":"https://www.aja.com/support/item/10457","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/aja-helo-plus-stored-xss-via-system-name-parameter","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-103584","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T23:16:57.737","lastModified":"2026-10-01T16:17:36.807","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS).\n\nThis issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki CommonsMetadata extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/CommonsMetadata","versions":[{"version":"1.46","status":"affected"},{"version":"1.45","status":"affected"},{"version":"1.43","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","baseScore":1.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:52:52.080179Z","id":"CVE-2026-103584","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I66c102cae36a9d499c95c37db7458371c7c87258","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435999","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103585","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-30T23:16:57.890","lastModified":"2026-10-01T16:17:36.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS).\n\nThis issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"MediaWiki MediaSearch extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/r/mediawiki/extensions/MediaSearch","versions":[{"version":"1.46","status":"affected"},{"version":"1.45","status":"affected"},{"version":"1.43","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","baseScore":1.2,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:54:06.396166Z","id":"CVE-2026-103585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/q/I79e8200289bd120c3c971ba830776eaae779bb99","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435999","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-103587","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T23:16:58.027","lastModified":"2026-10-01T16:17:37.100","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where date_to and id_room_type parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript payload in these parameters that executes in an authenticated administrator's session when the victim follows the link."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Webkul","product":"QloApps","defaultStatus":"unaffected","programFiles":["modules/hotelreservationsystem/controllers/admin/AdminHotelRoomsBookingController.php"],"repo":"https://github.com/Qloapps/QloApps","packageURL":"pkg:github/Qloapps/QloApps","versions":[{"version":"0","lessThanOrEqual":"1.7.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:39:58.785247Z","id":"CVE-2026-103587","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/Qloapps/QloApps","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/controllers/admin/AdminHotelRoomsBookingController.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/modules/hotelreservationsystem/views/templates/admin/hotel_rooms_booking/helpers/view/_partials/booking-rooms.tpl","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/commit/1d06fd302a935d68203dbdb341d89482621769d7","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/pull/1884","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/four-reflected-xss-qloapps","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/reflected-xss-qloapps-via-booking-now","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-book-now-search-parameters","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/four-reflected-xss-qloapps","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://hackmd.io/@leediay/reflected-xss-qloapps-via-booking-now","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103588","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T23:16:58.257","lastModified":"2026-10-06T00:16:32.643","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's session when the victim follows the link."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Webkul","product":"QloApps","defaultStatus":"unaffected","programFiles":["controllers/admin/AdminModulesPositionsController.php"],"repo":"https://github.com/Qloapps/QloApps","packageURL":"pkg:github/Qloapps/QloApps","versions":[{"version":"0","lessThanOrEqual":"1.7.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T23:48:50.977754Z","id":"CVE-2026-103588","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/Qloapps/QloApps","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/admin/AdminModulesPositionsController.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/commit/7ed467d911086b190180d7f297e3b15ba31e82d5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/pull/1899","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/four-reflected-xss-qloapps","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-exceptions-field","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/four-reflected-xss-qloapps","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103589","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T23:16:58.430","lastModified":"2026-10-01T19:17:18.387","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious payloads to execute arbitrary JavaScript in the victim's administrative session."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Webkul","product":"QloApps","defaultStatus":"unaffected","programFiles":["admin/themes/default/template/controllers/products/configuration.tpl"],"repo":"https://github.com/Qloapps/QloApps","packageURL":"pkg:github/Qloapps/QloApps","versions":[{"version":"0","lessThanOrEqual":"1.7.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T18:57:33.060269Z","id":"CVE-2026-103589","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/Qloapps/QloApps","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/themes/default/template/controllers/products/configuration.tpl","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/commit/7ed467d911086b190180d7f297e3b15ba31e82d5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/pull/1899","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/four-reflected-xss-qloapps","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-room-type-editor","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/four-reflected-xss-qloapps","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-103590","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T23:16:58.600","lastModified":"2026-10-01T15:17:28.580","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restriction_min_los and restriction_max_los parameters, executing arbitrary JavaScript in the victim's administrative session."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Webkul","product":"QloApps","defaultStatus":"unaffected","programFiles":["admin/themes/default/template/controllers/products/lengthofstay.tpl"],"repo":"https://github.com/Qloapps/QloApps","packageURL":"pkg:github/Qloapps/QloApps","versions":[{"version":"0","lessThanOrEqual":"1.7.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T14:24:42.160599Z","id":"CVE-2026-103590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/Qloapps/QloApps","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/blob/v1.7.0/admin/themes/default/template/controllers/products/lengthofstay.tpl","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/commit/7ed467d911086b190180d7f297e3b15ba31e82d5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Qloapps/QloApps/pull/1899","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/four-reflected-xss-qloapps","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/qloapps-through-1.7.0-reflected-xss-via-length-of-stay-fields","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-103591","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T23:16:58.773","lastModified":"2026-10-02T16:16:43.040","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers can supply a non-URL repo_url value to bypass path containment checks and read any file accessible to the API process by specifying absolute file paths."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"AsyncFuncAI","product":"deepwiki-open","defaultStatus":"unaffected","programFiles":["api/services/codemap.py","api/routers/codemap.py"],"repo":"https://github.com/AsyncFuncAI/deepwiki-open","versions":[{"version":"0","lessThanOrEqual":"d92819a","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-02T16:03:35.961656Z","id":"CVE-2026-103591","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://github.com/AsyncFuncAI/deepwiki-open","source":"disclosure@vulncheck.com"},{"url":"https://github.com/AsyncFuncAI/deepwiki-open/blob/d92819a9c9f3b99416e3580ff235fc9d3adf8b89/api/repository.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/AsyncFuncAI/deepwiki-open/blob/d92819a9c9f3b99416e3580ff235fc9d3adf8b89/api/routers/codemap.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/AsyncFuncAI/deepwiki-open/blob/d92819a9c9f3b99416e3580ff235fc9d3adf8b89/api/services/codemap.py","source":"disclosure@vulncheck.com"},{"url":"https://github.com/AsyncFuncAI/deepwiki-open/issues/590","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/deepwiki-open-through-commit-d92819a-unauthenticated-arbitrary-file-read-via-codemap-file","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-103592","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-30T23:16:58.963","lastModified":"2026-10-06T00:16:32.783","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to impersonate whitelisted addresses or evade blacklists, gaining access to IP-restricted routes."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"pecee","product":"simple-router","defaultStatus":"unaffected","programFiles":["src/Pecee/Http/Middleware/IpRestrictAccess.php","src/Pecee/Http/Request.php"],"repo":"https://github.com/skipperbent/simple-php-router","packageURL":"pkg:composer/pecee/simple-router","versions":[{"version":"0","lessThanOrEqual":"5.4.1.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T23:50:14.071677Z","id":"CVE-2026-103592","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-348"}]}],"references":[{"url":"https://github.com/skipperbent/simple-php-router","source":"disclosure@vulncheck.com"},{"url":"https://github.com/skipperbent/simple-php-router/blob/5.4.1.7/src/Pecee/Http/Middleware/IpRestrictAccess.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/skipperbent/simple-php-router/blob/5.4.1.7/src/Pecee/Http/Request.php","source":"disclosure@vulncheck.com"},{"url":"https://github.com/skipperbent/simple-php-router/issues/727","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/simple-php-router-through-5.4.1.7-ip-restriction-bypass-via-forwarding-headers","source":"disclosure@vulncheck.com"}]}}]}