{"resultsPerPage":406,"startIndex":0,"totalResults":406,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-25T03:32:14.648","vulnerabilities":[{"cve":{"id":"CVE-2026-105168","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T00:16:58.373","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file admin/admin.php of the component Order Assignment Block. The manipulation of the argument order_id/delivery_person_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kishor-23","product":"food-waste-management-system","cpes":["cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:*"],"modules":["Order Assignment Block"],"versions":[{"version":"411989e3ecb82895e53dca7865f72145f03d7d93","status":"affected"},{"version":"b3a70b2c492dc9904de5be1ad9389bd79b87f82c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:06:15.889537Z","id":"CVE-2026-105168","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/kishor-23/food-waste-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/kishor-23/food-waste-management-system/issues/8","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105168","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970272","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413400","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413400/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105169","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T00:16:58.547","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This impacts an unknown function of the file delivery/delivery.php of the component Take Order Handler. The manipulation of the argument order_id/delivery_person_id results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kishor-23","product":"food-waste-management-system","cpes":["cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:*"],"modules":["Take Order Handler"],"versions":[{"version":"411989e3ecb82895e53dca7865f72145f03d7d93","status":"affected"},{"version":"b3a70b2c492dc9904de5be1ad9389bd79b87f82c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:19:45.338231Z","id":"CVE-2026-105169","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/kishor-23/food-waste-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/kishor-23/food-waste-management-system/issues/9","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105169","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970275","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413401","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413401/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105170","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T00:16:58.720","lastModified":"2026-10-06T23:16:55.460","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an unknown function of the file admin/signup.php of the component Admin Signup. This manipulation of the argument sign causes missing authentication. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kishor-23","product":"food-waste-management-system","cpes":["cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:*"],"modules":["Admin Signup"],"versions":[{"version":"411989e3ecb82895e53dca7865f72145f03d7d93","status":"affected"},{"version":"b3a70b2c492dc9904de5be1ad9389bd79b87f82c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T22:06:04.082260Z","id":"CVE-2026-105170","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/kishor-23/food-waste-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/kishor-23/food-waste-management-system/issues/10","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105170","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970276","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413402","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413402/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105171","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T00:16:58.887","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected by this vulnerability is an unknown functionality of the file admin/admin.php of the component Role Attribute Handler. Such manipulation of the argument Name leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kishor-23","product":"food-waste-management-system","cpes":["cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:*"],"modules":["Role Attribute Handler"],"versions":[{"version":"411989e3ecb82895e53dca7865f72145f03d7d93","status":"affected"},{"version":"b3a70b2c492dc9904de5be1ad9389bd79b87f82c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:56:59.009478Z","id":"CVE-2026-105171","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/kishor-23/food-waste-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/kishor-23/food-waste-management-system/issues/11","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105171","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970277","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413403","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413403/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105172","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T01:16:27.157","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in itsourcecode Online Admission System 1.0. Affected by this issue is some unknown functionality of the file /login1.php. Performing a manipulation of the argument User results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Online Admission System","cpes":["cpe:2.3:a:itsourcecode:online_admission_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:06:32.900428Z","id":"CVE-2026-105172","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/10RZC22/cve_submit/issues/1","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105172","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970308","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413404","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413404/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105173","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T01:16:27.847","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"code-projects","product":"Human Resource Management","cpes":["cpe:2.3:a:code-projects:human_resource_management:*:*:*:*:*:*:*:*"],"modules":["Event Creation"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:20:15.460119Z","id":"CVE-2026-105173","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://code-projects.org/","source":"cna@vuldb.com"},{"url":"https://github.com/ahmad-masa100/CVEsmasa100/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Human%20Resource%20Management%20System%20in%20PHP.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105173","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970488","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413405","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413405/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105174","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T01:16:28.020","lastModified":"2026-10-06T23:16:55.607","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function project_create of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument project_name leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 6e481078cfba6388a67ca2d9792288405019ba3e. Applying a patch is the recommended action to fix this issue."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Gerapy","cpes":["cpe:2.3:a:gerapy:gerapy:*:*:*:*:*:*:*:*"],"modules":["Project Management"],"versions":[{"version":"0.9.0","status":"affected"},{"version":"0.9.1","status":"affected"},{"version":"0.9.2","status":"affected"},{"version":"0.9.3","status":"affected"},{"version":"0.9.4","status":"affected"},{"version":"0.9.5","status":"affected"},{"version":"0.9.6","status":"affected"},{"version":"0.9.7","status":"affected"},{"version":"0.9.8","status":"affected"},{"version":"0.9.9","status":"affected"},{"version":"0.9.10","status":"affected"},{"version":"0.9.11","status":"affected"},{"version":"0.9.12","status":"affected"},{"version":"0.9.13","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P","baseScore":5.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T22:18:10.169308Z","id":"CVE-2026-105174","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/Gerapy/Gerapy/","source":"cna@vuldb.com"},{"url":"https://github.com/Gerapy/Gerapy/commit/6e481078cfba6388a67ca2d9792288405019ba3e","source":"cna@vuldb.com"},{"url":"https://github.com/Gerapy/Gerapy/issues/317","source":"cna@vuldb.com"},{"url":"https://github.com/Gerapy/Gerapy/pull/319","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105174","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970586","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413406","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413406/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105175","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T01:16:28.190","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /Auth/add_student.php of the component Student Registration. The manipulation of the argument cmdschool results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Drug Recommendation System","cpes":["cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*"],"modules":["Student Registration"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:46:26.931210Z","id":"CVE-2026-105175","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-105175","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970929","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413407","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413407/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970929","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105223","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-05T01:16:28.480","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer tokens or Basic credentials and tamper with WebSocket or REST API traffic."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"maclof","product":"kubernetes-client","defaultStatus":"unaffected","packageURL":"pkg:composer/maclof/kubernetes-client","versions":[{"version":"0.17.0","lessThan":"0.32.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:11:24.748045Z","id":"CVE-2026-105223","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://github.com/maclof/kubernetes-client","source":"disclosure@vulncheck.com"},{"url":"https://github.com/maclof/kubernetes-client/blob/0.31.0/src/Client.php#L309-L312","source":"disclosure@vulncheck.com"},{"url":"https://github.com/maclof/kubernetes-client/commit/924c0b935fa538ed6b4b0948127609e99d0e6f34","source":"disclosure@vulncheck.com"},{"url":"https://github.com/maclof/kubernetes-client/issues/135","source":"disclosure@vulncheck.com"},{"url":"https://github.com/maclof/kubernetes-client/releases/tag/0.32.0","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/maclof-kubernetes-client-0.17.0-before-0.32.0-disabled-tls-certificate-verification","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105292","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-05T01:16:28.630","lastModified":"2026-10-06T23:16:56.197","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing the victim into the attacker's account so default data sync uploads saved hosts, passwords, and private keys."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"chaterm","product":"Chaterm","defaultStatus":"unaffected","versions":[{"version":"0.2.0","lessThan":"0.12.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T22:19:32.755031Z","id":"CVE-2026-105292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/Chaterm/Chaterm","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Chaterm/Chaterm/blob/v0.12.0/src/main/index.ts#L3442-L3455","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Chaterm/Chaterm/commit/41f747f17845cd980f289cc9ea8ff9978b6f7ad6","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Chaterm/Chaterm/pull/2326","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Chaterm/Chaterm/releases/tag/v0.12.1","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/chaterm-before-0.12.1-login-csrf-via-chaterm-oauth-callback","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105293","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-05T01:16:28.780","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Legcord","product":"Legcord","defaultStatus":"unaffected","versions":[{"version":"1.1.0","lessThanOrEqual":"1.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:52:51.768600Z","id":"CVE-2026-105293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/Legcord/Legcord","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Legcord/Legcord/blob/v1.3.0/src/common/themes.ts#L269-L276","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L201-L206","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Legcord/Legcord/issues/1163","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/legcord-1.1.0-through-1.3.0-path-traversal-via-theme-ipc-handlers","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105294","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-05T01:16:28.923","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Legcord","product":"Legcord","defaultStatus":"unaffected","versions":[{"version":"1.1.0","lessThanOrEqual":"1.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:18:28.394263Z","id":"CVE-2026-105294","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-15"}]}],"references":[{"url":"https://github.com/Legcord/Legcord","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L296-L299","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Legcord/Legcord/blob/v1.3.0/src/main.ts#L277-L307","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Legcord/Legcord/issues/1163","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/legcord-1.1.0-through-1.3.0-chromium-switch-injection-via-settings-setconfig","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105295","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-05T01:16:29.063","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic update checks, offer a fake version, and execute code as the user upon installation."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"gitahead","product":"GitAhead","defaultStatus":"unaffected","versions":[{"version":"2.5.0","lessThanOrEqual":"2.7.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:21:08.097317Z","id":"CVE-2026-105295","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-494"}]}],"references":[{"url":"https://github.com/gitahead/gitahead","source":"disclosure@vulncheck.com"},{"url":"https://github.com/gitahead/gitahead/blob/v2.7.1/src/app/Application.cpp#L284-L309","source":"disclosure@vulncheck.com"},{"url":"https://github.com/gitahead/gitahead/blob/v2.7.1/src/update/Updater.cpp#L176-L279","source":"disclosure@vulncheck.com"},{"url":"https://github.com/gitahead/gitahead/issues/662","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gitahead-2.5.0-through-2.7.1-unverified-update-installation-and-tls-bypass","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-105176","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T02:16:48.307","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /Admin/edit_class.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Drug Recommendation System","cpes":["cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:06:53.818542Z","id":"CVE-2026-105176","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-105176","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970932","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413408","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413408/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105177","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T02:16:49.670","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. The affected element is an unknown function of the file /Admin/add_drug.php of the component Drug Creation. Such manipulation of the argument txtname/cmdtype/txtusage/txtsideeffect/cmdcontraindication leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Drug Recommendation System","cpes":["cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*"],"modules":["Drug Creation"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:21:37.660793Z","id":"CVE-2026-105177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-105177","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970933","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413409","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413409/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105178","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T02:16:49.850","lastModified":"2026-10-06T23:16:55.757","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. The impacted element is the function mysqli_real_escape_string of the file /Admin/add_symptom.php of the component Symptom Creation. Performing a manipulation of the argument txtname results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Drug Recommendation System","cpes":["cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*"],"modules":["Symptom Creation"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T22:20:23.770736Z","id":"CVE-2026-105178","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-105178","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970934","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413410","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413410/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105179","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T02:16:50.033","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/add_user.php of the component Password Handler. Executing a manipulation of the argument Password can lead to missing encryption of sensitive data. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Drug Recommendation System","cpes":["cpe:2.3:a:sourcecodester:drug_recommendation_system:*:*:*:*:*:*:*:*"],"modules":["Password Handler"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:N/A:N","baseScore":3.3,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.4,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:39:13.466673Z","id":"CVE-2026-105179","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-310"},{"lang":"en","value":"CWE-311"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-105179","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970935","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413411","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413411/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105180","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T02:16:50.217","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in Jeebase 0.0.1. This vulnerability affects the function updateUser of the file /user/update/info of the component UserService. Executing a manipulation of the argument user/tempUser can lead to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Jeebase","cpes":["cpe:2.3:a:jeebase:jeebase:*:*:*:*:*:*:*:*"],"modules":["UserService"],"versions":[{"version":"0.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:07:05.078623Z","id":"CVE-2026-105180","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-913"},{"lang":"en","value":"CWE-915"}]}],"references":[{"url":"https://github.com/wmz1930/Jeebase/issues/88","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105180","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/971178","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413417","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413417/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-20519","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:50.393","lastModified":"2026-10-08T14:49:49.330","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778993; Issue ID: MSV-8898."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8695","status":"affected"},{"version":"MT8696","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20519","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8695_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3DFF5EC1-6ED0-4B93-AC08-B9909F499D23"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8695:-:*:*:*:*:*:*:*","matchCriteriaId":"B5126E05-25DC-4EF7-8DDE-BBA38A7547FB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0E6EB8-31E4-4702-891A-9B34C0535BD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*","matchCriteriaId":"26573298-76BC-49FE-8D99-CF03ED01B185"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20520","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:50.540","lastModified":"2026-10-08T14:32:52.177","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778988; Issue ID: MSV-8897."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8695","status":"affected"},{"version":"MT8696","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20520","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8695_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3DFF5EC1-6ED0-4B93-AC08-B9909F499D23"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8695:-:*:*:*:*:*:*:*","matchCriteriaId":"B5126E05-25DC-4EF7-8DDE-BBA38A7547FB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0E6EB8-31E4-4702-891A-9B34C0535BD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*","matchCriteriaId":"26573298-76BC-49FE-8D99-CF03ED01B185"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20521","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:50.660","lastModified":"2026-10-08T15:46:51.303","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Video HAL, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11375674; Issue ID: MSV-9571."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2718","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8126","status":"affected"},{"version":"MT8171","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8395","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8695","status":"affected"},{"version":"MT8696","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8799","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2718_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DDCA451B-219B-4490-98F3-60A569B5C513"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*","matchCriteriaId":"F5506327-7DDF-4E88-9EA8-10B8E32F848B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8126_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5A54A9D4-A63F-42CC-A69D-5EB23648C458"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8126:-:*:*:*:*:*:*:*","matchCriteriaId":"D9BA240B-3E89-4119-9167-8BD688358065"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8171_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C81DAF70-74E7-4EBC-AE1A-63DDBAE4B6C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8171:-:*:*:*:*:*:*:*","matchCriteriaId":"6A91AE7A-DADC-47A0-9F82-6E872F57D915"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3CEE2EEE-3512-429F-9DAD-E17D64CE447D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*","matchCriteriaId":"E4932D34-06F4-49D7-81FB-772A82E8A5B5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4E513B6-2909-4CA3-AF80-F1AE88BE4F18"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*","matchCriteriaId":"ED210E64-6CE7-42B1-849E-68C0E22521F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32C24935-B6E6-4923-B81C-D29BBEED2B3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:*","matchCriteriaId":"A28FA947-314F-465B-8ADD-F7973F02D82A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16860004-FEBE-4904-952E-222A9AFD0A2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*","matchCriteriaId":"43B2824E-8D18-4DD7-91E7-41578B2FCD6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6EFD0432-40B9-4121-9F13-D15645C60191"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*","matchCriteriaId":"D98FBE1C-D57B-49D9-9C4E-8A133A0C1C89"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8695_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3DFF5EC1-6ED0-4B93-AC08-B9909F499D23"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8695:-:*:*:*:*:*:*:*","matchCriteriaId":"B5126E05-25DC-4EF7-8DDE-BBA38A7547FB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0E6EB8-31E4-4702-891A-9B34C0535BD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*","matchCriteriaId":"26573298-76BC-49FE-8D99-CF03ED01B185"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB8ADEB7-A1A3-4781-BB65-4D2AF9896F80"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:*","matchCriteriaId":"ACB27F98-6318-44C8-A28D-375A357A03CA"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20522","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:50.793","lastModified":"2026-10-08T15:39:53.847","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249050; Issue ID: MSV-9172."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6881","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20523","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:50.917","lastModified":"2026-10-08T15:37:33.090","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249062; Issue ID: MSV-9171."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6881","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20524","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:51.040","lastModified":"2026-10-08T15:33:19.047","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In apu, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249004; Issue ID: MSV-9170."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6899","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1285"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20525","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:51.163","lastModified":"2026-10-08T15:23:06.023","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01870473 / MOLY00814393; Issue ID: MSV-9041."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:16:18.568161Z","id":"CVE-2026-20525","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-617"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20526","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:51.283","lastModified":"2026-10-08T15:22:00.860","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01898195; Issue ID: MSV-8906."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20527","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:51.397","lastModified":"2026-10-08T15:19:51.637","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01864925 / MOLY01210562; Issue ID: MSV-8303."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:16:06.590936Z","id":"CVE-2026-20527","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20528","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:51.520","lastModified":"2026-10-09T15:03:38.953","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In ccci, there is a possible out of bounds write and read due to a missing bounds check. This could lead to local information disclosure, memory corruption, crashes, or privilege escalation if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS11428950 (Note: For MT6880, MT6890) / ALPS10563453 (Note: For MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988) / AUTO00858766 (Note: For MT2735, MT2737); Issue ID: MSV-9893."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6980D","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6986D","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6990","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6980d_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"63E39158-4501-494C-B989-4572AB72E970"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6980d:-:*:*:*:*:*:*:*","matchCriteriaId":"2758122C-4D11-4D34-9B72-3905F3A28448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986d_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"49A0D3BF-5423-4204-A167-A43489C056F8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986d:-:*:*:*:*:*:*:*","matchCriteriaId":"68AA1CF7-F1CB-44A0-980E-DB32D9E379B9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20529","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:51.640","lastModified":"2026-10-09T15:02:40.510","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11276677; Issue ID: MSV-9217."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6761","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8171","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8799","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8171_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C81DAF70-74E7-4EBC-AE1A-63DDBAE4B6C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8171:-:*:*:*:*:*:*:*","matchCriteriaId":"6A91AE7A-DADC-47A0-9F82-6E872F57D915"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3CEE2EEE-3512-429F-9DAD-E17D64CE447D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*","matchCriteriaId":"E4932D34-06F4-49D7-81FB-772A82E8A5B5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB8ADEB7-A1A3-4781-BB65-4D2AF9896F80"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:*","matchCriteriaId":"ACB27F98-6318-44C8-A28D-375A357A03CA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20530","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:51.780","lastModified":"2026-10-09T14:59:57.243","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11292777; Issue ID: MSV-9195."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2718","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8126","status":"affected"},{"version":"MT8171","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8793","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2718_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DDCA451B-219B-4490-98F3-60A569B5C513"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*","matchCriteriaId":"F5506327-7DDF-4E88-9EA8-10B8E32F848B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8126_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5A54A9D4-A63F-42CC-A69D-5EB23648C458"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8126:-:*:*:*:*:*:*:*","matchCriteriaId":"D9BA240B-3E89-4119-9167-8BD688358065"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8171_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C81DAF70-74E7-4EBC-AE1A-63DDBAE4B6C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8171:-:*:*:*:*:*:*:*","matchCriteriaId":"6A91AE7A-DADC-47A0-9F82-6E872F57D915"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20531","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:51.907","lastModified":"2026-10-09T14:50:56.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In apu, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249016; Issue ID: MSV-9169."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6899","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20532","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:52.033","lastModified":"2026-10-09T14:47:40.227","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249024; Issue ID: MSV-9168."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6899","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:15:38.601853Z","id":"CVE-2026-20532","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-415"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20533","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:52.150","lastModified":"2026-10-09T14:37:22.450","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In display, there is a possible escalation of privilege due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11296678; Issue ID: MSV-9167."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8171","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8793","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20533","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8171_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C81DAF70-74E7-4EBC-AE1A-63DDBAE4B6C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8171:-:*:*:*:*:*:*:*","matchCriteriaId":"6A91AE7A-DADC-47A0-9F82-6E872F57D915"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20534","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:52.273","lastModified":"2026-10-09T14:36:13.577","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01797547; Issue ID: MSV-9155."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8666","status":"affected"},{"version":"MT8667","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8673","status":"affected"},{"version":"MT8675","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8789","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8795T","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:14:50.531934Z","id":"CVE-2026-20534","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6762_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"712798EA-AE09-4053-9124-E16E1FB309F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:*","matchCriteriaId":"C445EB80-6021-4E26-B74E-1B4B6910CE48"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6763_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7545A96-E05D-4A48-818C-5F172C594F54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*","matchCriteriaId":"2F19C76A-50DF-4ACA-BACA-07157B4D838B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6767_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0ED6AF6-9F84-47AB-8D9D-F5BBFD851093"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6767:-:*:*:*:*:*:*:*","matchCriteriaId":"3367BA13-9C4D-4CCF-8E71-397F33CFF773"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C98C5B2-1B08-4E46-A845-3B19EE801A9E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*","matchCriteriaId":"BE4D2AED-C713-407F-A34A-52C3D8F65835"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6779_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2C031857-65FD-4644-AF44-F9D09303472D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*","matchCriteriaId":"EBA369B8-8E23-492B-82CC-23114E6A5D1C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6783_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21ABBF98-6C62-4C4E-AF1E-4EB94D20544C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*","matchCriteriaId":"F2C8F9C2-6471-4498-B089-2F40D2483487"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6785_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2569740E-FAF9-4324-9399-F6C0A03D4C25"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*","matchCriteriaId":"A82E0A4F-072F-474C-B94C-8114ABE05639"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8666_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9BC2E651-1240-4250-BE65-AF889B3FB7E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8666:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9AB4D2-0EDD-4D5E-9393-F535CA2F24C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8667_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B83A0689-C64C-4741-93C8-96482901C7C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8667:-:*:*:*:*:*:*:*","matchCriteriaId":"2FE14B46-C1CA-465F-8578-059FA2ED30EB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8673_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"84687740-E3E8-4E57-8652-7C13C68E9C81"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*","matchCriteriaId":"152F6606-FA23-4530-AA07-419866B74CB3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C6C0C0F1-A7BA-4CDF-AD61-5E8DF981C9F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*","matchCriteriaId":"03E6123A-7603-4EAB-AFFB-229E8A040709"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8101C877-8499-4B45-9478-17A6A242E1B3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*","matchCriteriaId":"3AACF35D-27E0-49AF-A667-13585C8B8071"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766r_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"934CDBC2-33EC-4C78-8C82-711869C9CED5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766r:-:*:*:*:*:*:*:*","matchCriteriaId":"738475DC-9FA8-4034-AB1F-F89C77CE7B41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD62F681-A2D1-4A8B-B087-7835ED500D69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*","matchCriteriaId":"FE10C121-F2AD-43D2-8FF9-A6C197858220"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"24D97CE5-6EC8-4B90-8AFC-983359C5EE62"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8789:-:*:*:*:*:*:*:*","matchCriteriaId":"1505AD53-987E-4328-8E1D-F5F1EC12B677"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8795t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9B56BCCC-319E-4AF5-BDC4-6FCB600754C0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8795t:-:*:*:*:*:*:*:*","matchCriteriaId":"78D4E9E1-B044-41EC-BE98-22DC0E5E9010"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20535","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:52.393","lastModified":"2026-10-09T14:29:10.763","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In aidl, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11185216; Issue ID: MSV-9039."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20536","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:52.507","lastModified":"2026-10-09T14:27:49.533","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11242428; Issue ID: MSV-9038."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8695","status":"affected"},{"version":"MT8696","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20536","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8695_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3DFF5EC1-6ED0-4B93-AC08-B9909F499D23"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8695:-:*:*:*:*:*:*:*","matchCriteriaId":"B5126E05-25DC-4EF7-8DDE-BBA38A7547FB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0E6EB8-31E4-4702-891A-9B34C0535BD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*","matchCriteriaId":"26573298-76BC-49FE-8D99-CF03ED01B185"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20537","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:52.623","lastModified":"2026-10-09T16:45:36.343","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11185225; Issue ID: MSV-9024."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6878","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20537","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20538","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:52.753","lastModified":"2026-10-09T17:35:41.830","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8914."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8666","status":"affected"},{"version":"MT8667","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8673","status":"affected"},{"version":"MT8675","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8789","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8795T","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:14:07.744570Z","id":"CVE-2026-20538","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-126"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6762_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"712798EA-AE09-4053-9124-E16E1FB309F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:*","matchCriteriaId":"C445EB80-6021-4E26-B74E-1B4B6910CE48"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6763_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7545A96-E05D-4A48-818C-5F172C594F54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*","matchCriteriaId":"2F19C76A-50DF-4ACA-BACA-07157B4D838B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6767_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0ED6AF6-9F84-47AB-8D9D-F5BBFD851093"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6767:-:*:*:*:*:*:*:*","matchCriteriaId":"3367BA13-9C4D-4CCF-8E71-397F33CFF773"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C98C5B2-1B08-4E46-A845-3B19EE801A9E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*","matchCriteriaId":"BE4D2AED-C713-407F-A34A-52C3D8F65835"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6779_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2C031857-65FD-4644-AF44-F9D09303472D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*","matchCriteriaId":"EBA369B8-8E23-492B-82CC-23114E6A5D1C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6783_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21ABBF98-6C62-4C4E-AF1E-4EB94D20544C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*","matchCriteriaId":"F2C8F9C2-6471-4498-B089-2F40D2483487"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6785_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2569740E-FAF9-4324-9399-F6C0A03D4C25"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*","matchCriteriaId":"A82E0A4F-072F-474C-B94C-8114ABE05639"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8666_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9BC2E651-1240-4250-BE65-AF889B3FB7E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8666:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9AB4D2-0EDD-4D5E-9393-F535CA2F24C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8667_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B83A0689-C64C-4741-93C8-96482901C7C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8667:-:*:*:*:*:*:*:*","matchCriteriaId":"2FE14B46-C1CA-465F-8578-059FA2ED30EB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8673_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"84687740-E3E8-4E57-8652-7C13C68E9C81"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*","matchCriteriaId":"152F6606-FA23-4530-AA07-419866B74CB3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C6C0C0F1-A7BA-4CDF-AD61-5E8DF981C9F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*","matchCriteriaId":"03E6123A-7603-4EAB-AFFB-229E8A040709"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8101C877-8499-4B45-9478-17A6A242E1B3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*","matchCriteriaId":"3AACF35D-27E0-49AF-A667-13585C8B8071"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766r_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"934CDBC2-33EC-4C78-8C82-711869C9CED5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766r:-:*:*:*:*:*:*:*","matchCriteriaId":"738475DC-9FA8-4034-AB1F-F89C77CE7B41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD62F681-A2D1-4A8B-B087-7835ED500D69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*","matchCriteriaId":"FE10C121-F2AD-43D2-8FF9-A6C197858220"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"24D97CE5-6EC8-4B90-8AFC-983359C5EE62"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8789:-:*:*:*:*:*:*:*","matchCriteriaId":"1505AD53-987E-4328-8E1D-F5F1EC12B677"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8795t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9B56BCCC-319E-4AF5-BDC4-6FCB600754C0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8795t:-:*:*:*:*:*:*:*","matchCriteriaId":"78D4E9E1-B044-41EC-BE98-22DC0E5E9010"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20539","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:52.883","lastModified":"2026-10-09T17:36:26.260","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8913."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8666","status":"affected"},{"version":"MT8667","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8673","status":"affected"},{"version":"MT8675","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8789","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8795T","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:13:45.819311Z","id":"CVE-2026-20539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-126"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6762_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"712798EA-AE09-4053-9124-E16E1FB309F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:*","matchCriteriaId":"C445EB80-6021-4E26-B74E-1B4B6910CE48"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6763_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7545A96-E05D-4A48-818C-5F172C594F54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*","matchCriteriaId":"2F19C76A-50DF-4ACA-BACA-07157B4D838B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6767_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0ED6AF6-9F84-47AB-8D9D-F5BBFD851093"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6767:-:*:*:*:*:*:*:*","matchCriteriaId":"3367BA13-9C4D-4CCF-8E71-397F33CFF773"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C98C5B2-1B08-4E46-A845-3B19EE801A9E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*","matchCriteriaId":"BE4D2AED-C713-407F-A34A-52C3D8F65835"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6779_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2C031857-65FD-4644-AF44-F9D09303472D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*","matchCriteriaId":"EBA369B8-8E23-492B-82CC-23114E6A5D1C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6783_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21ABBF98-6C62-4C4E-AF1E-4EB94D20544C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*","matchCriteriaId":"F2C8F9C2-6471-4498-B089-2F40D2483487"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6785_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2569740E-FAF9-4324-9399-F6C0A03D4C25"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*","matchCriteriaId":"A82E0A4F-072F-474C-B94C-8114ABE05639"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8666_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9BC2E651-1240-4250-BE65-AF889B3FB7E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8666:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9AB4D2-0EDD-4D5E-9393-F535CA2F24C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8667_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B83A0689-C64C-4741-93C8-96482901C7C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8667:-:*:*:*:*:*:*:*","matchCriteriaId":"2FE14B46-C1CA-465F-8578-059FA2ED30EB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8673_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"84687740-E3E8-4E57-8652-7C13C68E9C81"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*","matchCriteriaId":"152F6606-FA23-4530-AA07-419866B74CB3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C6C0C0F1-A7BA-4CDF-AD61-5E8DF981C9F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*","matchCriteriaId":"03E6123A-7603-4EAB-AFFB-229E8A040709"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8101C877-8499-4B45-9478-17A6A242E1B3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*","matchCriteriaId":"3AACF35D-27E0-49AF-A667-13585C8B8071"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766r_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"934CDBC2-33EC-4C78-8C82-711869C9CED5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766r:-:*:*:*:*:*:*:*","matchCriteriaId":"738475DC-9FA8-4034-AB1F-F89C77CE7B41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD62F681-A2D1-4A8B-B087-7835ED500D69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*","matchCriteriaId":"FE10C121-F2AD-43D2-8FF9-A6C197858220"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"24D97CE5-6EC8-4B90-8AFC-983359C5EE62"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8789:-:*:*:*:*:*:*:*","matchCriteriaId":"1505AD53-987E-4328-8E1D-F5F1EC12B677"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8795t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9B56BCCC-319E-4AF5-BDC4-6FCB600754C0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8795t:-:*:*:*:*:*:*:*","matchCriteriaId":"78D4E9E1-B044-41EC-BE98-22DC0E5E9010"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20540","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:53.010","lastModified":"2026-10-09T17:36:44.673","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8912."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8666","status":"affected"},{"version":"MT8667","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8673","status":"affected"},{"version":"MT8675","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8789","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8795T","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:13:07.908538Z","id":"CVE-2026-20540","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-126"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6762_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"712798EA-AE09-4053-9124-E16E1FB309F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:*","matchCriteriaId":"C445EB80-6021-4E26-B74E-1B4B6910CE48"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6763_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7545A96-E05D-4A48-818C-5F172C594F54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*","matchCriteriaId":"2F19C76A-50DF-4ACA-BACA-07157B4D838B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6767_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0ED6AF6-9F84-47AB-8D9D-F5BBFD851093"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6767:-:*:*:*:*:*:*:*","matchCriteriaId":"3367BA13-9C4D-4CCF-8E71-397F33CFF773"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C98C5B2-1B08-4E46-A845-3B19EE801A9E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*","matchCriteriaId":"BE4D2AED-C713-407F-A34A-52C3D8F65835"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6779_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2C031857-65FD-4644-AF44-F9D09303472D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*","matchCriteriaId":"EBA369B8-8E23-492B-82CC-23114E6A5D1C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6783_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21ABBF98-6C62-4C4E-AF1E-4EB94D20544C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*","matchCriteriaId":"F2C8F9C2-6471-4498-B089-2F40D2483487"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6785_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2569740E-FAF9-4324-9399-F6C0A03D4C25"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*","matchCriteriaId":"A82E0A4F-072F-474C-B94C-8114ABE05639"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8666_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9BC2E651-1240-4250-BE65-AF889B3FB7E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8666:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9AB4D2-0EDD-4D5E-9393-F535CA2F24C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8667_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B83A0689-C64C-4741-93C8-96482901C7C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8667:-:*:*:*:*:*:*:*","matchCriteriaId":"2FE14B46-C1CA-465F-8578-059FA2ED30EB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8673_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"84687740-E3E8-4E57-8652-7C13C68E9C81"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*","matchCriteriaId":"152F6606-FA23-4530-AA07-419866B74CB3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C6C0C0F1-A7BA-4CDF-AD61-5E8DF981C9F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*","matchCriteriaId":"03E6123A-7603-4EAB-AFFB-229E8A040709"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8101C877-8499-4B45-9478-17A6A242E1B3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*","matchCriteriaId":"3AACF35D-27E0-49AF-A667-13585C8B8071"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766r_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"934CDBC2-33EC-4C78-8C82-711869C9CED5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766r:-:*:*:*:*:*:*:*","matchCriteriaId":"738475DC-9FA8-4034-AB1F-F89C77CE7B41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD62F681-A2D1-4A8B-B087-7835ED500D69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*","matchCriteriaId":"FE10C121-F2AD-43D2-8FF9-A6C197858220"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"24D97CE5-6EC8-4B90-8AFC-983359C5EE62"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8789:-:*:*:*:*:*:*:*","matchCriteriaId":"1505AD53-987E-4328-8E1D-F5F1EC12B677"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8795t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9B56BCCC-319E-4AF5-BDC4-6FCB600754C0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8795t:-:*:*:*:*:*:*:*","matchCriteriaId":"78D4E9E1-B044-41EC-BE98-22DC0E5E9010"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20541","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:53.140","lastModified":"2026-10-09T17:36:56.537","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8911."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8666","status":"affected"},{"version":"MT8667","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8673","status":"affected"},{"version":"MT8675","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8789","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8795T","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:11:38.723190Z","id":"CVE-2026-20541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-126"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8666_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9BC2E651-1240-4250-BE65-AF889B3FB7E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8666:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9AB4D2-0EDD-4D5E-9393-F535CA2F24C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8667_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B83A0689-C64C-4741-93C8-96482901C7C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8667:-:*:*:*:*:*:*:*","matchCriteriaId":"2FE14B46-C1CA-465F-8578-059FA2ED30EB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8673_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"84687740-E3E8-4E57-8652-7C13C68E9C81"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*","matchCriteriaId":"152F6606-FA23-4530-AA07-419866B74CB3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C6C0C0F1-A7BA-4CDF-AD61-5E8DF981C9F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*","matchCriteriaId":"03E6123A-7603-4EAB-AFFB-229E8A040709"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8101C877-8499-4B45-9478-17A6A242E1B3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*","matchCriteriaId":"3AACF35D-27E0-49AF-A667-13585C8B8071"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766r_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"934CDBC2-33EC-4C78-8C82-711869C9CED5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766r:-:*:*:*:*:*:*:*","matchCriteriaId":"738475DC-9FA8-4034-AB1F-F89C77CE7B41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD62F681-A2D1-4A8B-B087-7835ED500D69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*","matchCriteriaId":"FE10C121-F2AD-43D2-8FF9-A6C197858220"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"24D97CE5-6EC8-4B90-8AFC-983359C5EE62"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8789:-:*:*:*:*:*:*:*","matchCriteriaId":"1505AD53-987E-4328-8E1D-F5F1EC12B677"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8795t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9B56BCCC-319E-4AF5-BDC4-6FCB600754C0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8795t:-:*:*:*:*:*:*:*","matchCriteriaId":"78D4E9E1-B044-41EC-BE98-22DC0E5E9010"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6762_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"712798EA-AE09-4053-9124-E16E1FB309F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:*","matchCriteriaId":"C445EB80-6021-4E26-B74E-1B4B6910CE48"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6763_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7545A96-E05D-4A48-818C-5F172C594F54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*","matchCriteriaId":"2F19C76A-50DF-4ACA-BACA-07157B4D838B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6767_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0ED6AF6-9F84-47AB-8D9D-F5BBFD851093"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6767:-:*:*:*:*:*:*:*","matchCriteriaId":"3367BA13-9C4D-4CCF-8E71-397F33CFF773"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C98C5B2-1B08-4E46-A845-3B19EE801A9E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*","matchCriteriaId":"BE4D2AED-C713-407F-A34A-52C3D8F65835"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6779_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2C031857-65FD-4644-AF44-F9D09303472D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*","matchCriteriaId":"EBA369B8-8E23-492B-82CC-23114E6A5D1C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6783_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21ABBF98-6C62-4C4E-AF1E-4EB94D20544C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*","matchCriteriaId":"F2C8F9C2-6471-4498-B089-2F40D2483487"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6785_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2569740E-FAF9-4324-9399-F6C0A03D4C25"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*","matchCriteriaId":"A82E0A4F-072F-474C-B94C-8114ABE05639"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20542","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:53.270","lastModified":"2026-10-09T17:37:29.853","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11076799; Issue ID: MSV-8143."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2718","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT8171","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8370","status":"affected"},{"version":"MT8371","status":"affected"},{"version":"MT8390","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8395","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8796","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2718_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DDCA451B-219B-4490-98F3-60A569B5C513"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*","matchCriteriaId":"F5506327-7DDF-4E88-9EA8-10B8E32F848B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8171_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C81DAF70-74E7-4EBC-AE1A-63DDBAE4B6C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8171:-:*:*:*:*:*:*:*","matchCriteriaId":"6A91AE7A-DADC-47A0-9F82-6E872F57D915"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7619B640-32C6-435B-AABB-E3D11C3B03FE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8370:-:*:*:*:*:*:*:*","matchCriteriaId":"DA2B6BB9-7544-41A7-BF3A-344AA4CC4B31"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8371_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"10C6D722-06CE-4C33-B67B-D5E92BD2B66C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8371:-:*:*:*:*:*:*:*","matchCriteriaId":"7A5AEBAB-CE39-4272-83ED-18E6528787E5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9627AD8C-49C7-43C4-850E-6BC37FA2F619"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*","matchCriteriaId":"B774B7D7-B7DD-43A0-833F-7E39DF82CA60"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16860004-FEBE-4904-952E-222A9AFD0A2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*","matchCriteriaId":"43B2824E-8D18-4DD7-91E7-41578B2FCD6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6EFD0432-40B9-4121-9F13-D15645C60191"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*","matchCriteriaId":"D98FBE1C-D57B-49D9-9C4E-8A133A0C1C89"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20543","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:53.410","lastModified":"2026-10-08T14:30:09.693","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Modem, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01645293; Issue ID: MSV-6761."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2716","status":"affected"},{"version":"MT2735","status":"affected"},{"version":"MT2737","status":"affected"},{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6762","status":"affected"},{"version":"MT6763","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6767","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6771","status":"affected"},{"version":"MT6779","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6783","status":"affected"},{"version":"MT6785","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6813","status":"affected"},{"version":"MT6815","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6873","status":"affected"},{"version":"MT6875","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6880","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6890","status":"affected"},{"version":"MT6891","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6896","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6980","status":"affected"},{"version":"MT6982","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6986","status":"affected"},{"version":"MT6988","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6990","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8666","status":"affected"},{"version":"MT8667","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8673","status":"affected"},{"version":"MT8675","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8766R","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8789","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8795T","status":"affected"},{"version":"MT8796","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:10:48.524682Z","id":"CVE-2026-20543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-215"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2716_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A2F958B4-BC5E-40CF-A3E6-3D923DD0296A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2716:-:*:*:*:*:*:*:*","matchCriteriaId":"6FCBDB1C-E6E1-46A4-A727-A752D720DCA6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A0D40745-FA7E-40DF-BCA6-24CECBB0AE43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:*","matchCriteriaId":"7F1D09FC-5BE9-4B23-82F1-3C6EAC5711A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"85F4E58C-A9BC-4116-A844-B94C6B6566FA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:*","matchCriteriaId":"9C2A1118-B5F7-4EF5-B329-0887B5F3430E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6762_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"712798EA-AE09-4053-9124-E16E1FB309F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6762:-:*:*:*:*:*:*:*","matchCriteriaId":"C445EB80-6021-4E26-B74E-1B4B6910CE48"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6763_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F7545A96-E05D-4A48-818C-5F172C594F54"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*","matchCriteriaId":"2F19C76A-50DF-4ACA-BACA-07157B4D838B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6767_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0ED6AF6-9F84-47AB-8D9D-F5BBFD851093"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6767:-:*:*:*:*:*:*:*","matchCriteriaId":"3367BA13-9C4D-4CCF-8E71-397F33CFF773"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"4C98C5B2-1B08-4E46-A845-3B19EE801A9E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*","matchCriteriaId":"BE4D2AED-C713-407F-A34A-52C3D8F65835"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6779_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2C031857-65FD-4644-AF44-F9D09303472D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*","matchCriteriaId":"EBA369B8-8E23-492B-82CC-23114E6A5D1C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6783_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"21ABBF98-6C62-4C4E-AF1E-4EB94D20544C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6783:-:*:*:*:*:*:*:*","matchCriteriaId":"F2C8F9C2-6471-4498-B089-2F40D2483487"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6785_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2569740E-FAF9-4324-9399-F6C0A03D4C25"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*","matchCriteriaId":"A82E0A4F-072F-474C-B94C-8114ABE05639"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0E1CB25C-4643-4239-AE47-B5AE876416ED"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*","matchCriteriaId":"66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6815_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6FE3EEC2-1B07-40FA-90CA-3209C3578FA2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6815:-:*:*:*:*:*:*:*","matchCriteriaId":"B7122918-8C44-4F24-82E4-B8448247FC83"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3E12A313-E835-4912-9392-E33428C1AC78"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*","matchCriteriaId":"F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5228A4E6-9E36-41E4-A157-3CBA6C79DE06"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6875:-:*:*:*:*:*:*:*","matchCriteriaId":"80BDC5EC-E822-4BC7-8C0D-E8AD8396E8FE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"1A5C1637-BAC7-47C0-AD84-B0404083A857"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:*","matchCriteriaId":"68CF4A7A-3136-4C4C-A795-81323896BE11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB9AC17B-5ED8-4B58-A7A0-B146DD1DD244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*","matchCriteriaId":"171D1C08-F055-44C0-913C-AA2B73AF5B72"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6891_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"089C2A15-9566-4140-AA86-E8906E05660C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6891:-:*:*:*:*:*:*:*","matchCriteriaId":"D8E91CA4-CA5B-40D1-9A96-2B875104BCF4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6896_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"662B041E-793C-4F30-A018-6212A4781390"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6896:-:*:*:*:*:*:*:*","matchCriteriaId":"33DEF766-EAF1-4E36-BB7C-43069B26507A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6980_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB98938B-ED9E-4459-BA32-B1679E4B0DB7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6980:-:*:*:*:*:*:*:*","matchCriteriaId":"BA9131F6-F167-4FD7-8FBF-B372CBBCF46F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6982_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3D882579-3305-482E-89A7-3CC37AB7C9C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6982:-:*:*:*:*:*:*:*","matchCriteriaId":"DFB497BE-A045-4673-874C-7337E62CC606"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"17581EC0-D68B-4EA3-845C-366C4A65FC6B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:*","matchCriteriaId":"1F419FE2-2D6D-48EE-9B6C-E88AC5D44186"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8680C37E-850E-4302-A6B6-F78DCAC7A905"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*","matchCriteriaId":"ADB95144-97C3-4329-99DB-CB1B6FBB8A2D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7273471C-6471-43C7-82DE-8551CFC9C39A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*","matchCriteriaId":"1A76806D-A4E3-466A-90CB-E9FFE478E7A0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8666_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9BC2E651-1240-4250-BE65-AF889B3FB7E1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8666:-:*:*:*:*:*:*:*","matchCriteriaId":"6C9AB4D2-0EDD-4D5E-9393-F535CA2F24C4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8667_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B83A0689-C64C-4741-93C8-96482901C7C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8667:-:*:*:*:*:*:*:*","matchCriteriaId":"2FE14B46-C1CA-465F-8578-059FA2ED30EB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8673_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"84687740-E3E8-4E57-8652-7C13C68E9C81"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*","matchCriteriaId":"152F6606-FA23-4530-AA07-419866B74CB3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8675_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C6C0C0F1-A7BA-4CDF-AD61-5E8DF981C9F1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8675:-:*:*:*:*:*:*:*","matchCriteriaId":"03E6123A-7603-4EAB-AFFB-229E8A040709"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8101C877-8499-4B45-9478-17A6A242E1B3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8765:-:*:*:*:*:*:*:*","matchCriteriaId":"3AACF35D-27E0-49AF-A667-13585C8B8071"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766r_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"934CDBC2-33EC-4C78-8C82-711869C9CED5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766r:-:*:*:*:*:*:*:*","matchCriteriaId":"738475DC-9FA8-4034-AB1F-F89C77CE7B41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8771_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9F17C468-79B8-4FD6-8AB2-80E8781EAEEC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8771:-:*:*:*:*:*:*:*","matchCriteriaId":"0D09F23D-D023-4A60-B426-61251FDD8A5A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD62F681-A2D1-4A8B-B087-7835ED500D69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*","matchCriteriaId":"FE10C121-F2AD-43D2-8FF9-A6C197858220"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"24D97CE5-6EC8-4B90-8AFC-983359C5EE62"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8789:-:*:*:*:*:*:*:*","matchCriteriaId":"1505AD53-987E-4328-8E1D-F5F1EC12B677"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6D15A887-AC6B-4458-8355-8505742F4FC2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB05B1D-77C9-4E42-91AD-9F087413DC20"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8795t_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9B56BCCC-319E-4AF5-BDC4-6FCB600754C0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8795t:-:*:*:*:*:*:*:*","matchCriteriaId":"78D4E9E1-B044-41EC-BE98-22DC0E5E9010"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6DC17C8D-377F-4343-BE7E-359224912061"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*","matchCriteriaId":"DE933AD9-3A6F-421B-8AB3-C45F8DEA9548"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8797_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E2FBC8-3C13-4663-8BFF-AA6B66F3F260"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8797:-:*:*:*:*:*:*:*","matchCriteriaId":"2B469BF4-5961-42E9-814B-1BE06D182E45"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20544","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:53.560","lastModified":"2026-10-09T17:34:57.870","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In meta, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11049530 / ALPS11480843; Issue ID: MSV-7935."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6881","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8126","status":"affected"},{"version":"MT8171","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8370","status":"affected"},{"version":"MT8390","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8668","status":"affected"},{"version":"MT8676","status":"affected"},{"version":"MT8678","status":"affected"},{"version":"MT8755","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8775","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788","status":"affected"},{"version":"MT8791","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8799","status":"affected"},{"version":"MT8863","status":"affected"},{"version":"MT8873","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8883","status":"affected"},{"version":"MT8893","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:37:54.902037Z","id":"CVE-2026-20544","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6739_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"14B94ECB-CAD4-499C-8959-1713FC5CE423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6739:-:*:*:*:*:*:*:*","matchCriteriaId":"7FA8A390-9F52-4CF3-9B45-936CE3E2B828"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2493FB05-7723-4CDD-AC2A-8B21C4285436"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*","matchCriteriaId":"F726F486-A86F-4215-AD93-7A07A071844A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"43327018-578C-4997-81B9-6DBD3679E40C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*","matchCriteriaId":"43E779F6-F0A0-4153-9A1D-B715C3A2F80E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"23F92B7C-A5A3-4F32-B4BF-CBE706D79702"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*","matchCriteriaId":"C4EEE021-6B2A-47A0-AC6B-55525A40D718"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6835_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"00B1D726-8183-4667-B46D-18EF110EA9D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*","matchCriteriaId":"19A63103-C708-48EC-B44D-5E465A6B79C5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAA5C86-701B-4116-8A63-EB89B3DC2B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*","matchCriteriaId":"366F1912-756B-443E-9962-224937DD7DFB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3BECB082-4B77-4ECC-968B-B00E48C06240"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*","matchCriteriaId":"C61AD730-66FE-4605-A89B-3B8D6526D612"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6878_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"207954E6-D413-4762-9F4A-3A147CFB4FE2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*","matchCriteriaId":"855A8046-34ED-4891-ACE5-76AB10AC8D53"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6879_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"502901D0-8B2D-449A-A2D6-E8914D5D4239"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*","matchCriteriaId":"704BE5CE-AE08-4432-A8B0-4C8BD62148AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"62A37FFA-30EF-4788-9EB5-E1202FA16C38"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*","matchCriteriaId":"9F7C1B31-4E33-4939-A926-79FE401368CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"22321E12-7EB8-46B7-ABB6-23ACC1436EFD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6883:-:*:*:*:*:*:*:*","matchCriteriaId":"15E2EC3F-9FB3-488B-B1C1-2793A416C755"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6885_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8A6E25F4-C394-4830-8EC3-2AF0563F5032"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*","matchCriteriaId":"DD64413C-C774-4C4F-9551-89E1AA9469EE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6886_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E10F9AFE-9F99-4B91-BF26-49E035FC8079"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*","matchCriteriaId":"AF3E2B84-DAFE-4E11-B23B-026F719475F5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6889_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD17D854-2394-483D-B8E2-FDA1BC837DAD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6889:-:*:*:*:*:*:*:*","matchCriteriaId":"3B787DC3-8E5A-4968-B20B-37B6257FAAE2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"0A272644-3BC4-438B-BAC0-DDF164BF4097"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*","matchCriteriaId":"213B5C7F-D965-4312-9CDF-4F06FA77D401"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6895_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"110CBA4A-26A6-4E4E-A0C6-35FA02A6D4AF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*","matchCriteriaId":"E0CA45C9-7BFE-4C93-B2AF-B86501F763AB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6897_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A04EA650-730F-4E5D-A0E0-90570CACDD5E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*","matchCriteriaId":"2A7D8055-F4B6-41EE-A078-11D56285AB66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6899_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BEBA484A-EC07-4D3D-80CD-BDE9E7807F71"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*","matchCriteriaId":"C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6983_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"967E956F-07B4-4957-9C84-DDB5C38E5E69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*","matchCriteriaId":"EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6985_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CA30A145-D98E-4DA7-84C7-377402951190"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*","matchCriteriaId":"EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E495B8EB-C9B5-4F32-AEE2-D2C41C0B292B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*","matchCriteriaId":"AD7DE6B2-66D9-4A3E-B15F-D56505559255"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D9DD2119-39E8-4A9C-8E2A-8FB7F92A1001"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*","matchCriteriaId":"CBBB30DF-E963-4940-B742-F6801F68C3FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAEB2240-FF37-4CBE-BBEF-8A8281153646"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*","matchCriteriaId":"57E92BE0-5E65-4770-8E1A-0E5D07A38164"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8126_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5A54A9D4-A63F-42CC-A69D-5EB23648C458"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8126:-:*:*:*:*:*:*:*","matchCriteriaId":"D9BA240B-3E89-4119-9167-8BD688358065"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8171_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C81DAF70-74E7-4EBC-AE1A-63DDBAE4B6C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8171:-:*:*:*:*:*:*:*","matchCriteriaId":"6A91AE7A-DADC-47A0-9F82-6E872F57D915"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4E513B6-2909-4CA3-AF80-F1AE88BE4F18"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*","matchCriteriaId":"ED210E64-6CE7-42B1-849E-68C0E22521F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32C24935-B6E6-4923-B81C-D29BBEED2B3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:*","matchCriteriaId":"A28FA947-314F-465B-8ADD-F7973F02D82A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8370_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7619B640-32C6-435B-AABB-E3D11C3B03FE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8370:-:*:*:*:*:*:*:*","matchCriteriaId":"DA2B6BB9-7544-41A7-BF3A-344AA4CC4B31"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8390_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9627AD8C-49C7-43C4-850E-6BC37FA2F619"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*","matchCriteriaId":"B774B7D7-B7DD-43A0-833F-7E39DF82CA60"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16860004-FEBE-4904-952E-222A9AFD0A2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*","matchCriteriaId":"43B2824E-8D18-4DD7-91E7-41578B2FCD6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8755_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6B49A54E-B0C5-45C4-8396-5E6A2613E3B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8755:-:*:*:*:*:*:*:*","matchCriteriaId":"1CF88096-5CBD-4A4B-8F47-33D38985956F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"215862D7-BF3D-4955-BCFF-48778190EEB5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*","matchCriteriaId":"CE45F606-2E75-48BC-9D1B-99D504974CBF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"303069C6-F031-4176-9465-46F4134BB423"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*","matchCriteriaId":"1CC6E254-11A9-49CE-83FE-6DAC23E7D7AA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"FAA319BC-2689-497C-8D7D-482CD2AD89A1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*","matchCriteriaId":"DE5FB550-7264-4879-BAF9-6798949113AF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"88A514F4-3EAF-45FB-8736-4A015E4DEB4E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:*","matchCriteriaId":"9D2D5F91-6AAB-4516-AD01-5C60F58BA4A6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CD62F681-A2D1-4A8B-B087-7835ED500D69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788:-:*:*:*:*:*:*:*","matchCriteriaId":"FE10C121-F2AD-43D2-8FF9-A6C197858220"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8791_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AA74322E-6A1D-4B6F-87D7-9A4CD8D14C47"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8791:-:*:*:*:*:*:*:*","matchCriteriaId":"9CD2C3EC-B62D-4616-964F-FDBE5B14A449"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8798_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C91FB79A-E095-40BB-8141-240D69CAB131"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8798:-:*:*:*:*:*:*:*","matchCriteriaId":"637CAAD2-DCC0-4F81-B781-5D0536844CA8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB8ADEB7-A1A3-4781-BB65-4D2AF9896F80"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:*","matchCriteriaId":"ACB27F98-6318-44C8-A28D-375A357A03CA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8863_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"03A3F0E1-3226-4CB5-AE9F-BDA327590107"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8863:-:*:*:*:*:*:*:*","matchCriteriaId":"77E0D738-F0B9-468F-8A10-204F498320BC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8873_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9D40337A-B78E-41CF-ADDC-A31190950F73"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*","matchCriteriaId":"D6DD525F-7050-42BD-829D-1121698B8009"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8875_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AD8A54C8-5AA0-4CDB-BC78-269693782274"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8875:-:*:*:*:*:*:*:*","matchCriteriaId":"85431E0F-9B72-4ACB-B9FB-08C7ABAC4B6A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C5049DE8-5F0C-4E0D-85AE-F47CECE2DCE8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*","matchCriteriaId":"23DD8281-FEB4-4E23-8DDA-680FF895F12E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8E905861-38DA-4023-9751-2CD2EDE489EF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*","matchCriteriaId":"CCFAADB1-C2B2-47A6-BB66-761B964E7DFB"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20579","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:53.683","lastModified":"2026-10-21T08:16:43.237","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9800."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2718","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8395","status":"affected"},{"version":"MT8696","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8799","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2718_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DDCA451B-219B-4490-98F3-60A569B5C513"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*","matchCriteriaId":"F5506327-7DDF-4E88-9EA8-10B8E32F848B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3CEE2EEE-3512-429F-9DAD-E17D64CE447D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*","matchCriteriaId":"E4932D34-06F4-49D7-81FB-772A82E8A5B5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4E513B6-2909-4CA3-AF80-F1AE88BE4F18"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*","matchCriteriaId":"ED210E64-6CE7-42B1-849E-68C0E22521F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32C24935-B6E6-4923-B81C-D29BBEED2B3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:*","matchCriteriaId":"A28FA947-314F-465B-8ADD-F7973F02D82A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16860004-FEBE-4904-952E-222A9AFD0A2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*","matchCriteriaId":"43B2824E-8D18-4DD7-91E7-41578B2FCD6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6EFD0432-40B9-4121-9F13-D15645C60191"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*","matchCriteriaId":"D98FBE1C-D57B-49D9-9C4E-8A133A0C1C89"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0E6EB8-31E4-4702-891A-9B34C0535BD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*","matchCriteriaId":"26573298-76BC-49FE-8D99-CF03ED01B185"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB8ADEB7-A1A3-4781-BB65-4D2AF9896F80"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:*","matchCriteriaId":"ACB27F98-6318-44C8-A28D-375A357A03CA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20586","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:53.803","lastModified":"2026-10-21T08:16:43.503","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9614."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2718","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8395","status":"affected"},{"version":"MT8696","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8799","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2718_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DDCA451B-219B-4490-98F3-60A569B5C513"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*","matchCriteriaId":"F5506327-7DDF-4E88-9EA8-10B8E32F848B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3CEE2EEE-3512-429F-9DAD-E17D64CE447D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*","matchCriteriaId":"E4932D34-06F4-49D7-81FB-772A82E8A5B5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4E513B6-2909-4CA3-AF80-F1AE88BE4F18"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*","matchCriteriaId":"ED210E64-6CE7-42B1-849E-68C0E22521F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32C24935-B6E6-4923-B81C-D29BBEED2B3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:*","matchCriteriaId":"A28FA947-314F-465B-8ADD-F7973F02D82A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16860004-FEBE-4904-952E-222A9AFD0A2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*","matchCriteriaId":"43B2824E-8D18-4DD7-91E7-41578B2FCD6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6EFD0432-40B9-4121-9F13-D15645C60191"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*","matchCriteriaId":"D98FBE1C-D57B-49D9-9C4E-8A133A0C1C89"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0E6EB8-31E4-4702-891A-9B34C0535BD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*","matchCriteriaId":"26573298-76BC-49FE-8D99-CF03ED01B185"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB8ADEB7-A1A3-4781-BB65-4D2AF9896F80"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:*","matchCriteriaId":"ACB27F98-6318-44C8-A28D-375A357A03CA"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20587","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:53.913","lastModified":"2026-10-21T08:16:43.677","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In mtee, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9608."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2718","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8395","status":"affected"},{"version":"MT8696","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8799","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2718_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DDCA451B-219B-4490-98F3-60A569B5C513"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*","matchCriteriaId":"F5506327-7DDF-4E88-9EA8-10B8E32F848B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3CEE2EEE-3512-429F-9DAD-E17D64CE447D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*","matchCriteriaId":"E4932D34-06F4-49D7-81FB-772A82E8A5B5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4E513B6-2909-4CA3-AF80-F1AE88BE4F18"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*","matchCriteriaId":"ED210E64-6CE7-42B1-849E-68C0E22521F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32C24935-B6E6-4923-B81C-D29BBEED2B3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:*","matchCriteriaId":"A28FA947-314F-465B-8ADD-F7973F02D82A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16860004-FEBE-4904-952E-222A9AFD0A2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*","matchCriteriaId":"43B2824E-8D18-4DD7-91E7-41578B2FCD6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6EFD0432-40B9-4121-9F13-D15645C60191"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*","matchCriteriaId":"D98FBE1C-D57B-49D9-9C4E-8A133A0C1C89"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0E6EB8-31E4-4702-891A-9B34C0535BD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*","matchCriteriaId":"26573298-76BC-49FE-8D99-CF03ED01B185"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB8ADEB7-A1A3-4781-BB65-4D2AF9896F80"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:*","matchCriteriaId":"ACB27F98-6318-44C8-A28D-375A357A03CA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20588","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:54.033","lastModified":"2026-10-21T08:16:43.850","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In mtee, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9607."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2718","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8395","status":"affected"},{"version":"MT8696","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8799","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2718_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DDCA451B-219B-4490-98F3-60A569B5C513"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*","matchCriteriaId":"F5506327-7DDF-4E88-9EA8-10B8E32F848B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3CEE2EEE-3512-429F-9DAD-E17D64CE447D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*","matchCriteriaId":"E4932D34-06F4-49D7-81FB-772A82E8A5B5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4E513B6-2909-4CA3-AF80-F1AE88BE4F18"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*","matchCriteriaId":"ED210E64-6CE7-42B1-849E-68C0E22521F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32C24935-B6E6-4923-B81C-D29BBEED2B3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:*","matchCriteriaId":"A28FA947-314F-465B-8ADD-F7973F02D82A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16860004-FEBE-4904-952E-222A9AFD0A2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*","matchCriteriaId":"43B2824E-8D18-4DD7-91E7-41578B2FCD6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6EFD0432-40B9-4121-9F13-D15645C60191"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*","matchCriteriaId":"D98FBE1C-D57B-49D9-9C4E-8A133A0C1C89"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0E6EB8-31E4-4702-891A-9B34C0535BD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*","matchCriteriaId":"26573298-76BC-49FE-8D99-CF03ED01B185"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB8ADEB7-A1A3-4781-BB65-4D2AF9896F80"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:*","matchCriteriaId":"ACB27F98-6318-44C8-A28D-375A357A03CA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-20589","sourceIdentifier":"security@mediatek.com","published":"2026-10-05T02:16:54.150","lastModified":"2026-10-21T08:16:44.023","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9606."}],"affected":[{"source":"security@mediatek.com","affectedData":[{"vendor":"MediaTek, Inc.","product":"MediaTek chipset","defaultStatus":"unaffected","versions":[{"version":"MT2718","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6769","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT8186","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8195","status":"affected"},{"version":"MT8196","status":"affected"},{"version":"MT8367","status":"affected"},{"version":"MT8391","status":"affected"},{"version":"MT8395","status":"affected"},{"version":"MT8696","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8788E","status":"affected"},{"version":"MT8792","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8799","status":"affected"},{"version":"MT8910","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-20589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@mediatek.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt2718_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"DDCA451B-219B-4490-98F3-60A569B5C513"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:*","matchCriteriaId":"F5506327-7DDF-4E88-9EA8-10B8E32F848B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16EF9082-FC9B-4790-A79D-AA62C62E4B88"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*","matchCriteriaId":"06CD97E1-8A76-48B4-9780-9698EF5A960F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C435FED6-829E-4788-A61C-92A2250872AC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:*","matchCriteriaId":"D23991D5-1893-49F4-8A06-D5E66C96C3B3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"524AB96D-4C15-47A6-B276-6B873796E8F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*","matchCriteriaId":"8B9B0D82-82C1-4A77-A016-329B99C45F49"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BA0F3AD5-4D2B-4480-AA79-44EFD4E29348"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:*","matchCriteriaId":"9814939B-F05E-4870-90C0-7C0F6BAAEB39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"E997ED4F-33F3-4508-9B12-99DBA0D845B2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*","matchCriteriaId":"89AFEE24-7AAD-4EDB-8C3E-EDBA3240730A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"07F67D59-75F0-4056-BCCE-F7888912CAB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:*","matchCriteriaId":"7CA9352F-E9BD-4656-9B7C-4AFEE2C78E58"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3CEE2EEE-3512-429F-9DAD-E17D64CE447D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*","matchCriteriaId":"E4932D34-06F4-49D7-81FB-772A82E8A5B5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"30E10DDB-6D3D-42CB-9DB9-ED25E6163D3D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*","matchCriteriaId":"BA3D4A45-38EE-4125-AE67-89D1C707F95A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"527C8F57-8492-49BF-BCA9-0D77011D3493"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*","matchCriteriaId":"AE35C440-2C15-42FF-ADD0-D99C0FB7D1C9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"C4E513B6-2909-4CA3-AF80-F1AE88BE4F18"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*","matchCriteriaId":"ED210E64-6CE7-42B1-849E-68C0E22521F6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"EE7B4BD3-A945-4C45-8E76-CEE2ADE2001E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*","matchCriteriaId":"FB0C4D80-28BC-4C4D-B522-AD9EC5222A2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"32C24935-B6E6-4923-B81C-D29BBEED2B3C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:*","matchCriteriaId":"A28FA947-314F-465B-8ADD-F7973F02D82A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"16860004-FEBE-4904-952E-222A9AFD0A2F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:*","matchCriteriaId":"43B2824E-8D18-4DD7-91E7-41578B2FCD6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8395_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"6EFD0432-40B9-4121-9F13-D15645C60191"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*","matchCriteriaId":"D98FBE1C-D57B-49D9-9C4E-8A133A0C1C89"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"3EAACB56-716C-4E17-AB78-F5E68B75B791"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:*","matchCriteriaId":"2589C222-3D62-4BDB-98F2-5F1E38600D8D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"645D7C99-A0A0-4FB0-97AC-3DA5161A44D9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*","matchCriteriaId":"EE302F6F-170E-4350-A8F4-65BE0C50CB78"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"CFEC7A7B-6948-4B8A-BFA1-9F9D07043605"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*","matchCriteriaId":"152A5F3D-8004-4649-BDB1-E6F0798AF1CB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"8D0E6EB8-31E4-4702-891A-9B34C0535BD6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*","matchCriteriaId":"26573298-76BC-49FE-8D99-CF03ED01B185"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7E2280E5-F903-4541-8404-9F789CEFF172"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*","matchCriteriaId":"533284E5-C3AF-48D3-A287-993099DB2E41"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"65B4F295-BF35-4A71-8567-CB1B367D80E9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*","matchCriteriaId":"CEDF887A-1862-4336-ABFC-371838E1D029"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"AE904A76-14A2-41D5-86FF-BCA686342E85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*","matchCriteriaId":"336FC69E-E89F-4642-B6B9-8009D9A2BD52"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"42C2F52D-C49C-4AFF-B6FA-FFA82EF96142"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*","matchCriteriaId":"2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BB8ADEB7-A1A3-4781-BB65-4D2AF9896F80"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:*","matchCriteriaId":"ACB27F98-6318-44C8-A28D-375A357A03CA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"A05E635E-9559-4899-A7BA-A74EB6501D1C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*","matchCriteriaId":"8C81BC81-1358-4005-8D35-92428D052A65"}]}]}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/October-2026","source":"security@mediatek.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105181","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T03:16:38.367","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file register1.php. The manipulation of the argument fname leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Online Admission System","cpes":["cpe:2.3:a:itsourcecode:online_admission_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:22:02.762564Z","id":"CVE-2026-105181","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/hwy666666/submit/issues/1","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105181","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/971183","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413418","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413418/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105182","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T03:16:38.543","lastModified":"2026-10-06T23:16:55.900","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=update. The manipulation of the argument Title results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T22:21:44.865807Z","id":"CVE-2026-105182","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/turtlelionarmor/cve/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105182","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/971289","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413419","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413419/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105183","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T03:16:38.717","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in itsourcecode Online Admission System 1.0. The affected element is an unknown function of the file /admin/confirm.php. This manipulation of the argument schedid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Online Admission System","cpes":["cpe:2.3:a:itsourcecode:online_admission_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:32:03.970502Z","id":"CVE-2026-105183","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/ltranquility/submit/issues/24","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105183","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/971464","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413420","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413420/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105184","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T03:16:38.890","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in itsourcecode Online Admission System 1.0. The impacted element is an unknown function of the file /admin/creteria.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Online Admission System","cpes":["cpe:2.3:a:itsourcecode:online_admission_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:07:17.658891Z","id":"CVE-2026-105184","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/ltranquility/submit/issues/25","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105184","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/971467","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413421","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413421/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105185","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T04:17:01.990","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in itsourcecode Online Admission System 1.0. This affects an unknown function of the file /admin/examinee.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Online Admission System","cpes":["cpe:2.3:a:itsourcecode:online_admission_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:26:34.423770Z","id":"CVE-2026-105185","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/ltranquility/submit/issues/26","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105185","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/971468","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413422","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413422/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105186","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T04:17:07.673","lastModified":"2026-10-06T23:16:56.047","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in itsourcecode Online Admission System 1.0. This impacts an unknown function of the file /new.php. Executing a manipulation of the argument schedid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Online Admission System","cpes":["cpe:2.3:a:itsourcecode:online_admission_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T22:22:45.312258Z","id":"CVE-2026-105186","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/ltranquility/submit/issues/27","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105186","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/971469","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413423","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413423/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105187","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T04:17:07.887","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in itsourcecode Online Admission System 1.0. Affected is an unknown function of the file /admin/key.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Online Admission System","cpes":["cpe:2.3:a:itsourcecode:online_admission_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:27:06.266652Z","id":"CVE-2026-105187","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/ltranquility/submit/issues/28","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105187","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/971470","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413424","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413424/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105188","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T05:17:02.660","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/admin/liveEventHistory.php of the component Live Event History. The manipulation of the argument eventSubject results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"code-projects","product":"Human Resource Management System","cpes":["cpe:2.3:a:code-projects:human_resource_management_system:*:*:*:*:*:*:*:*"],"modules":["Live Event History"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:10:14.435777Z","id":"CVE-2026-105188","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://code-projects.org/","source":"cna@vuldb.com"},{"url":"https://github.com/user-attachments/assets/f4902bfb-fc8e-4e4c-8ef8-01fde7c51038","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105188","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/971660","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413425","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413425/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105225","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T05:17:02.900","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE_PAYMENT_INSTALLED leads to code injection. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"osCommerce","product":"osCommerce2","cpes":["cpe:2.3:a:oscommerce:oscommerce2:*:*:*:*:*:*:*:*"],"modules":["Payment Page"],"versions":[{"version":"2.3.4.0","status":"affected"},{"version":"2.3.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":0.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:26:10.487263Z","id":"CVE-2026-105225","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/osCommerce/oscommerce2/","source":"cna@vuldb.com"},{"url":"https://github.com/osCommerce/oscommerce2/issues/677","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105225","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/971046","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413427","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413427/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105226","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T05:17:03.087","lastModified":"2026-10-07T21:17:10.233","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"osCommerce","product":"osCommerce2","cpes":["cpe:2.3:a:oscommerce:oscommerce2:*:*:*:*:*:*:*:*"],"modules":["Newsletter Management"],"versions":[{"version":"2.3.4.0","status":"affected"},{"version":"2.3.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:39:03.568757Z","id":"CVE-2026-105226","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/osCommerce/oscommerce2/","source":"cna@vuldb.com"},{"url":"https://github.com/osCommerce/oscommerce2/issues/676","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105226","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/971047","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413428","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413428/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105229","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T05:17:03.260","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This issue affects some unknown processing of the file signup.php of the component User Registration Endpoint. Executing a manipulation of the argument email/name/gender can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kishor-23","product":"food-waste-management-system","cpes":["cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:*"],"modules":["User Registration Endpoint"],"versions":[{"version":"411989e3ecb82895e53dca7865f72145f03d7d93","status":"affected"},{"version":"b3a70b2c492dc9904de5be1ad9389bd79b87f82c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:20:09.672005Z","id":"CVE-2026-105229","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/kishor-23/food-waste-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/kishor-23/food-waste-management-system/issues/5","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105229","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/970269","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413429","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413429/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105230","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T06:16:56.120","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Impacted is an unknown function of the file delivery/deliverymyord.php. The manipulation of the argument delivery_person_id/order_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kishor-23","product":"food-waste-management-system","cpes":["cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:*"],"versions":[{"version":"411989e3ecb82895e53dca7865f72145f03d7d93","status":"affected"},{"version":"b3a70b2c492dc9904de5be1ad9389bd79b87f82c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:10:27.560885Z","id":"CVE-2026-105230","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/kishor-23/food-waste-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/kishor-23/food-waste-management-system/issues/13","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105230","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/972895","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413430","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413430/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105231","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T06:16:57.410","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is an unknown function of the file admin/signup.php of the component Admin Registration. The manipulation of the argument email/username/location results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kishor-23","product":"food-waste-management-system","cpes":["cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:*"],"modules":["Admin Registration"],"versions":[{"version":"411989e3ecb82895e53dca7865f72145f03d7d93","status":"affected"},{"version":"b3a70b2c492dc9904de5be1ad9389bd79b87f82c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:25:43.156264Z","id":"CVE-2026-105231","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/kishor-23/food-waste-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/kishor-23/food-waste-management-system/issues/15","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105231","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/972898","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413431","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413431/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105232","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T06:16:57.610","lastModified":"2026-10-07T21:17:10.390","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file delivery/deliverysignup.php of the component Registration Page. This manipulation of the argument username/email/location causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kishor-23","product":"food-waste-management-system","cpes":["cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:*"],"modules":["Registration Page"],"versions":[{"version":"411989e3ecb82895e53dca7865f72145f03d7d93","status":"affected"},{"version":"b3a70b2c492dc9904de5be1ad9389bd79b87f82c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:41:48.110224Z","id":"CVE-2026-105232","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/kishor-23/food-waste-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/kishor-23/food-waste-management-system/issues/14","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105232","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/972903","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413432","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413432/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105233","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T06:16:57.803","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to session fixiation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kishor-23","product":"food-waste-management-system","cpes":["cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:*"],"modules":["Login Flow"],"versions":[{"version":"411989e3ecb82895e53dca7865f72145f03d7d93","status":"affected"},{"version":"b3a70b2c492dc9904de5be1ad9389bd79b87f82c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:17:55.160609Z","id":"CVE-2026-105233","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-384"}]}],"references":[{"url":"https://github.com/kishor-23/food-waste-management-system/","source":"cna@vuldb.com"},{"url":"https://github.com/kishor-23/food-waste-management-system/issues/16","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105233","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/972904","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413433","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413433/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105237","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T06:16:57.997","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"linlinjava","product":"litemall","cpes":["cpe:2.3:a:linlinjava:litemall:*:*:*:*:*:*:*:*"],"modules":["Login Endpoint"],"versions":[{"version":"1.0","status":"affected"},{"version":"1.1","status":"affected"},{"version":"1.2","status":"affected"},{"version":"1.3","status":"affected"},{"version":"1.4","status":"affected"},{"version":"1.5","status":"affected"},{"version":"1.6","status":"affected"},{"version":"1.7","status":"affected"},{"version":"1.8.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:10:42.531519Z","id":"CVE-2026-105237","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-307"},{"lang":"en","value":"CWE-799"}]}],"references":[{"url":"https://github.com/linlinjava/litemall/","source":"cna@vuldb.com"},{"url":"https://github.com/linlinjava/litemall/issues/584","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105237","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/975124","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413449","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413449/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105301","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T06:16:58.207","lastModified":"2026-10-21T15:17:14.433","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This candidate was rejected after further investigation determined that it is not a security vulnerability. The client certificate chain is validated during mTLS negotiation at the TLS layer or reverse proxy before Keycloak processes CRL Distribution Point or OCSP URLs, so only certificates issued by a CA explicitly trusted by the administrator can trigger these requests."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-105302","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T06:16:58.383","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers. This allows a delegated client administrator to leak a user's upstream bearer tokens into the tokens issued to their managed application, potentially leading to unauthorized access to the user's data on external platforms."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:06:52.352902Z","id":"CVE-2026-105302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-105302","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545800","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-105306","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T06:16:58.530","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can register a client that bypasses audience checks during token introspection. This allows the attacker to view sensitive identity information, roles, and session details from access tokens belonging to other applications in the same realm."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:06:28.444251Z","id":"CVE-2026-105306","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-105306","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545802","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-13607","sourceIdentifier":"contact@wpscan.com","published":"2026-10-05T06:16:58.683","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"File Uploads Addon for WooCommerce","defaultStatus":"unknown","versions":[{"version":"1.7.2","lessThanOrEqual":"1.7.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:49:43.848180Z","id":"CVE-2026-13607","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6eb71c2f-5060-42ed-9a8f-c7ade01e32a9/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-78371","sourceIdentifier":"contact@wpscan.com","published":"2026-10-05T06:16:58.830","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"File Uploads Addon for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"1.7.2","lessThan":"1.7.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:49:34.621759Z","id":"CVE-2026-78371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7a9cda53-c62a-4249-baf2-7f25feeed17a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84169","sourceIdentifier":"contact@wpscan.com","published":"2026-10-05T06:16:59.180","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"UPI QR Code Payment Gateway","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"1.4.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:50:00.659969Z","id":"CVE-2026-84169","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/94a90832-4cf9-4664-9086-5705429f759c/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2017-20285","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-10-05T07:16:29.017","lastModified":"2026-10-06T17:17:08.657","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.\n\nA perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope.\n\nWhat DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"YAML","modules":["YAML"],"programFiles":["lib/YAML.pm","lib/YAML/Loader.pm","lib/YAML/Types.pm"],"programRoutines":[{"name":"YAML::Loader::_parse_explicit"},{"name":"YAML::Type::code::yaml_load"},{"name":"YAML::Type::regexp::yaml_load"}],"repo":"https://github.com/ingydotnet/yaml-pm","packageURL":"pkg:cpan/YAML","versions":[{"version":"0","lessThan":"1.30","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:02:52.193961Z","id":"CVE-2017-20285","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-470"},{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/ingydotnet/yaml-pm/commit/471314bbdcbd62077eea32755929122aa8bd00a3.patch","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://github.com/ingydotnet/yaml-pm/commit/7736f38bd02e4f9f77d5468721e3be3d7b34a8ec.patch","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://github.com/ingydotnet/yaml-pm/issues/176","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/TINITA/YAML-1.30/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/8","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2019-25777","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-10-05T07:16:29.557","lastModified":"2026-10-06T17:17:09.893","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.\n\nA perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options.\n\nA perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"YAML","modules":["YAML"],"programFiles":["lib/YAML/Types.pm"],"programRoutines":[{"name":"YAML::Type::glob::yaml_load"}],"repo":"https://github.com/ingydotnet/yaml-pm","packageURL":"pkg:cpan/YAML","versions":[{"version":"0","lessThan":"1.27_001","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:58:07.558999Z","id":"CVE-2019-25777","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-502"},{"lang":"en","value":"CWE-914"}]}],"references":[{"url":"https://github.com/ingydotnet/yaml-pm/commit/bace96b5e6661d521c7c515c94a09e081c911fce.patch","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://github.com/ingydotnet/yaml-pm/issues/212","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/TINITA/YAML-1.28/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/7","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-100727","sourceIdentifier":"vultures@jpcert.or.jp","published":"2026-10-05T07:16:29.787","lastModified":"2026-10-05T16:00:27.080","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as \"Local\"."}],"affected":[{"source":"vultures@jpcert.or.jp","affectedData":[{"vendor":"GROWI, Inc.","product":"GROWI","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"v7.5.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV30":[{"source":"vultures@jpcert.or.jp","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:24:34.162485Z","id":"CVE-2026-100727","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vultures@jpcert.or.jp","type":"Secondary","description":[{"lang":"en","value":"CWE-552"}]}],"references":[{"url":"https://growi.co.jp/news/47","source":"vultures@jpcert.or.jp"},{"url":"https://jvn.jp/en/jp/JVN24352487/","source":"vultures@jpcert.or.jp"}]}},{"cve":{"id":"CVE-2026-105238","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T07:16:30.180","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler. This manipulation of the argument x-base-url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ChatGPTNextWeb","product":"NextChat","cpes":["cpe:2.3:a:nextchat:nextchat:*:*:*:*:*:*:*:*"],"modules":["Proxy Fallback Handler"],"versions":[{"version":"2.16.0","status":"affected"},{"version":"2.16.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:25:09.109096Z","id":"CVE-2026-105238","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/ChatGPTNextWeb/NextChat/","source":"cna@vuldb.com"},{"url":"https://github.com/ChatGPTNextWeb/NextChat/issues/6813","source":"cna@vuldb.com"},{"url":"https://github.com/ChatGPTNextWeb/NextChat/pull/6884","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105238","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/975707","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413450","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413450/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105245","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T07:16:30.370","lastModified":"2026-10-07T21:17:10.550","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file python/sglang/srt/entrypoints/http_server.py of the component HTTP Endpoint. Such manipulation of the argument api_key leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"sgl-project","product":"sglang","cpes":["cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:*"],"modules":["HTTP Endpoint"],"versions":[{"version":"0.5.0","status":"affected"},{"version":"0.5.1","status":"affected"},{"version":"0.5.2","status":"affected"},{"version":"0.5.3","status":"affected"},{"version":"0.5.4","status":"affected"},{"version":"0.5.5","status":"affected"},{"version":"0.5.6","status":"affected"},{"version":"0.5.7","status":"affected"},{"version":"0.5.8","status":"affected"},{"version":"0.5.9","status":"affected"},{"version":"0.5.10","status":"affected"},{"version":"0.5.11","status":"affected"},{"version":"0.5.12","status":"affected"},{"version":"0.5.13","status":"affected"},{"version":"0.5.14","status":"affected"},{"version":"0.5.15","status":"affected"},{"version":"0.5.16","status":"affected"},{"version":"0.5.17","status":"affected"},{"version":"0.5.18","status":"affected"},{"version":"0.5.19","status":"affected"},{"version":"0.5.20","status":"affected"},{"version":"0.5.21","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:42:36.592062Z","id":"CVE-2026-105245","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-310"},{"lang":"en","value":"CWE-319"}]}],"references":[{"url":"https://github.com/sgl-project/sglang/","source":"cna@vuldb.com"},{"url":"https://github.com/sgl-project/sglang/issues/30166","source":"cna@vuldb.com"},{"url":"https://github.com/sgl-project/sglang/pull/30343","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105245","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/975910","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413451","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413451/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105246","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T07:16:30.630","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update. Performing a manipulation of the argument Subject results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:13:11.413552Z","id":"CVE-2026-105246","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/memory0433/cve/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105246","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/976274","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413452","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413452/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19954","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-10-05T07:16:30.820","lastModified":"2026-10-06T18:16:53.823","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.\n\npwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by \"cole\" encodes to \"xn--cole-pka\" rather than \"xn--cole-9oa\".\n\nThe Net::Whois::Raw library modules are not affected."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Net-Whois-Raw","modules":["Net::Whois::Raw"],"programFiles":["bin/pwhois"],"programRoutines":[{"name":"to_punycode"}],"repo":"https://github.com/regru/Net-Whois-Raw","packageURL":"pkg:cpan/Net-Whois-Raw","versions":[{"version":"0","lessThan":"2.99044","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:52:04.047979Z","id":"CVE-2026-19954","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-176"}]}],"references":[{"url":"https://github.com/regru/Net-Whois-Raw/issues/34","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://github.com/regru/Net-Whois-Raw/pull/35","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/NALOBIN/Net-Whois-Raw-2.99044/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/view/lib/Net/IDN/Punycode.pm#WARNING","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://www.rfc-editor.org/rfc/rfc5891#section-5.2","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/9","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-105247","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T08:17:15.020","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course. Executing a manipulation of the argument Subject can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:10:57.309296Z","id":"CVE-2026-105247","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/memory0433/cve/issues/2","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105247","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/976275","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413453","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413453/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105248","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T08:17:15.217","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_parser.c of the component TXTP File Handler. The manipulation results in out-of-bounds write. The attack may be launched remotely. The patch is identified as 4669d37a6af94866f6f0628678f9f90d46954e8b. It is best practice to apply a patch to resolve this issue."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"vgmstream","cpes":["cpe:2.3:a:vgmstream:vgmstream:*:*:*:*:*:*:*:*"],"modules":["TXTP File Handler"],"versions":[{"version":"r2117","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:24:09.987722Z","id":"CVE-2026-105248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/vgmstream/vgmstream/","source":"cna@vuldb.com"},{"url":"https://github.com/vgmstream/vgmstream/commit/4669d37a6af94866f6f0628678f9f90d46954e8b","source":"cna@vuldb.com"},{"url":"https://github.com/vgmstream/vgmstream/issues/1997","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105248","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/976278","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413455","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413455/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105249","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T08:17:15.417","lastModified":"2026-10-07T21:17:10.733","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"vgmstream","cpes":["cpe:2.3:a:vgmstream:vgmstream:*:*:*:*:*:*:*:*"],"modules":["TXTP File Handler"],"versions":[{"version":"r2117","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.4,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.3,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:S/C:P/I:P/A:P","baseScore":4.3,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.1,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:44:32.691469Z","id":"CVE-2026-105249","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://github.com/vgmstream/vgmstream/","source":"cna@vuldb.com"},{"url":"https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7a92024","source":"cna@vuldb.com"},{"url":"https://github.com/vgmstream/vgmstream/issues/1998","source":"cna@vuldb.com"},{"url":"https://github.com/vgmstream/vgmstream/pull/2008","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105249","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/976279","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413456","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413456/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105250","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T08:17:15.610","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decoder.c of the component Microsoft IMA Decoder. Such manipulation leads to divide by zero. The attack can be executed remotely."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"vgmstream","cpes":["cpe:2.3:a:vgmstream:vgmstream:*:*:*:*:*:*:*:*"],"modules":["Microsoft IMA Decoder"],"versions":[{"version":"r2117","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:09:21.459442Z","id":"CVE-2026-105250","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-369"},{"lang":"en","value":"CWE-404"}]}],"references":[{"url":"https://github.com/vgmstream/vgmstream/","source":"cna@vuldb.com"},{"url":"https://github.com/vgmstream/vgmstream/issues/1999","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105250","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/976280","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413457","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413457/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105314","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T08:17:15.797","lastModified":"2026-10-06T18:16:43.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Papermerge","product":"Papermerge","defaultStatus":"unknown","collectionURL":"https://pypi.org","packageName":"papermerge-core","programFiles":["papermerge/core/features/document/router.py","papermerge/core/pathlib.py","papermerge/storage/backends/local.py"],"programRoutines":[{"name":"upload_document"},{"name":"docver_path"},{"name":"LocalBackend.upload"}],"repo":"https://github.com/papermerge/papermerge-core","packageURL":"pkg:pypi/papermerge-core","versions":[{"version":"3.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:58:51.998241Z","id":"CVE-2026-105314","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-24"}]}],"references":[{"url":"https://github.com/kashishtopi/cve-pocs/blob/main/papermerge-core-arbitrary-file-write-rce/HR-papermerge-core-path-traversal-rce.pdf","source":"cve@mitre.org"},{"url":"https://github.com/kashishtopi/cve-pocs/tree/main/papermerge-core-arbitrary-file-write-rce","source":"cve@mitre.org"},{"url":"https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/features/document/router.py","source":"cve@mitre.org"},{"url":"https://github.com/papermerge/papermerge-core/blob/master/papermerge/core/pathlib.py","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-100102","sourceIdentifier":"security@puppet.com","published":"2026-10-05T09:17:05.540","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server."}],"affected":[{"source":"security@puppet.com","affectedData":[{"vendor":"Perforce","product":"P4 (Helix Core)","defaultStatus":"affected","packageName":"P4Search","versions":[{"version":"0","lessThanOrEqual":"2026.4.1","versionType":"custom","status":"affected"},{"version":"2026.4.2","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@puppet.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.5,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:14:23.110289Z","id":"CVE-2026-100102","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@puppet.com","type":"Secondary","description":[{"lang":"en","value":"CWE-489"}]}],"references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000003FE7NIAW/rce-via-exposed-jdwp-debug-agent-in-p4search","source":"security@puppet.com"}]}},{"cve":{"id":"CVE-2026-100103","sourceIdentifier":"security@puppet.com","published":"2026-10-05T09:17:05.717","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server."}],"affected":[{"source":"security@puppet.com","affectedData":[{"vendor":"Perfoce","product":"P4 (Helix Core)","defaultStatus":"affected","packageName":"P4Search","versions":[{"version":"0","lessThanOrEqual":"2026.4.1","versionType":"custom","status":"affected"},{"version":"2026.4.2","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@puppet.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:54:03.651976Z","id":"CVE-2026-100103","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@puppet.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1392"}]}],"references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000003FE8zIAG/authentication-bypass-via-default-auth-token-in-p4search","source":"security@puppet.com"}]}},{"cve":{"id":"CVE-2026-102393","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:05.850","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through 4.7.7."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Brainstorm Force","product":"Starter Templates","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"astra-sites","versions":[{"version":"0","lessThanOrEqual":"4.7.7","versionType":"custom","status":"affected","changes":[{"at":"4.7.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:57:05.394087Z","id":"CVE-2026-102393","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/astra-sites/vulnerability/wordpress-starter-templates-plugin-4-7-7-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102914","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:06.000","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Brainstorm Force","product":"Presto Player","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"presto-player","versions":[{"version":"0","lessThanOrEqual":"4.5.2","versionType":"custom","status":"affected","changes":[{"at":"4.5.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:57:27.286153Z","id":"CVE-2026-102914","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/presto-player/vulnerability/wordpress-presto-player-plugin-4-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103078","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:06.137","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Ahmad","product":"JS Help Desk","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"js-support-ticket","versions":[{"version":"0","lessThanOrEqual":"4.0.0","versionType":"custom","status":"affected","changes":[{"at":"5.0.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:46:56.189637Z","id":"CVE-2026-103078","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-4-0-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103079","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:06.277","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Ahmad","product":"JS Help Desk","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"js-support-ticket","versions":[{"version":"0","lessThanOrEqual":"4.0.0","versionType":"custom","status":"affected","changes":[{"at":"5.0.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:46:51.496797Z","id":"CVE-2026-103079","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-4-0-0-insecure-direct-object-references-idor-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103084","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:06.417","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"LeapWorx","product":"Premium Addons for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"premium-addons-for-elementor","versions":[{"version":"0","lessThanOrEqual":"4.11.109","versionType":"custom","status":"affected","changes":[{"at":"4.11.110","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:56:09.005273Z","id":"CVE-2026-103084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-11-109-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103335","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:06.553","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedded Sensitive Data.This issue affects Video Conferencing with Zoom: from n/a through 4.6.10."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Deepen Bajracharya","product":"Video Conferencing with Zoom","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"video-conferencing-with-zoom-api","versions":[{"version":"0","lessThanOrEqual":"4.6.10","versionType":"custom","status":"affected","changes":[{"at":"4.6.11","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:22:17.899891Z","id":"CVE-2026-103335","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/video-conferencing-with-zoom-api/vulnerability/wordpress-video-conferencing-with-zoom-plugin-4-6-10-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103351","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:06.693","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Magepeople inc.","product":"Taxi Booking Manager for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ecab-taxi-booking-manager","versions":[{"version":"0","lessThanOrEqual":"2.1.1","versionType":"custom","status":"affected","changes":[{"at":"2.1.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:47:44.166305Z","id":"CVE-2026-103351","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1284"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ecab-taxi-booking-manager/vulnerability/wordpress-taxi-booking-manager-for-woocommerce-plugin-2-1-1-other-vulnerability-type-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103507","sourceIdentifier":"security@puppet.com","published":"2026-10-05T09:17:06.843","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account."}],"affected":[{"source":"security@puppet.com","affectedData":[{"vendor":"Perforce","product":"P4 (Helix Core)","defaultStatus":"affected","packageName":"P4Search","versions":[{"version":"0","lessThanOrEqual":"2026.4.1","versionType":"custom","status":"affected"},{"version":"2026.4.2","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@puppet.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:28:25.514491Z","id":"CVE-2026-103507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@puppet.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000003FE49IAG/arbitrary-filewrite-via-log-configuration-path-in-p4search","source":"security@puppet.com"}]}},{"cve":{"id":"CVE-2026-103510","sourceIdentifier":"security@puppet.com","published":"2026-10-05T09:17:06.977","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server."}],"affected":[{"source":"security@puppet.com","affectedData":[{"vendor":"Perforce","product":"P4 (Helix Core)","defaultStatus":"affected","packageName":"P4Search","versions":[{"version":"0","lessThanOrEqual":"2026.4.1","versionType":"custom","status":"affected"},{"version":"2026.4.2","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@puppet.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.5,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:17:31.735930Z","id":"CVE-2026-103510","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@puppet.com","type":"Secondary","description":[{"lang":"en","value":"CWE-636"}]}],"references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000003FDw5IAG/authentication-bypass-via-blank-auth-token-in-p4search","source":"security@puppet.com"}]}},{"cve":{"id":"CVE-2026-103511","sourceIdentifier":"security@puppet.com","published":"2026-10-05T09:17:07.113","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory."}],"affected":[{"source":"security@puppet.com","affectedData":[{"vendor":"Perforce","product":"P4 (Helix Core)","defaultStatus":"affected","packageName":"P4Search","versions":[{"version":"0","lessThanOrEqual":"2026.4.1","versionType":"custom","status":"affected"},{"version":"2026.4.2","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@puppet.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:29:37.801772Z","id":"CVE-2026-103511","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@puppet.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000003FDpdIAG/arbitrary-filewrite-via-extension-installation-in-p4search","source":"security@puppet.com"}]}},{"cve":{"id":"CVE-2026-103512","sourceIdentifier":"security@puppet.com","published":"2026-10-05T09:17:07.247","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner."}],"affected":[{"source":"security@puppet.com","affectedData":[{"vendor":"Perforce","product":"P4 (Helix Core)","defaultStatus":"affected","packageName":"P4Search","versions":[{"version":"0","lessThanOrEqual":"2026.4.1","versionType":"custom","status":"affected"},{"version":"2026.4.2","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@puppet.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:32:36.852945Z","id":"CVE-2026-103512","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@puppet.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000003FDo1IAG/ticket-hostbinding-bypass-via-spoofed-client-ip-in-p4search","source":"security@puppet.com"}]}},{"cve":{"id":"CVE-2026-104386","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:07.380","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPFunnels Team","product":"WP VR","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpvr","versions":[{"version":"0","lessThanOrEqual":"9.1.3","versionType":"custom","status":"affected","changes":[{"at":"9.1.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:17:30.697818Z","id":"CVE-2026-104386","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpvr/vulnerability/wordpress-wp-vr-plugin-9-1-3-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104388","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:07.520","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issue affects PowerPress Podcasting: from n/a through 11.17.9."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"powerpress","versions":[{"version":"0","lessThanOrEqual":"11.17.9","versionType":"custom","status":"affected","changes":[{"at":"11.17.11","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:08:10.236195Z","id":"CVE-2026-104388","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-plugin-11-17-9-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104389","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:07.657","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Sirv","product":"Sirv","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"sirv","versions":[{"version":"0","lessThanOrEqual":"8.2.5","versionType":"custom","status":"affected","changes":[{"at":"8.2.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:17:09.655146Z","id":"CVE-2026-104389","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sirv/vulnerability/wordpress-sirv-plugin-8-2-5-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104396","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:07.793","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This issue affects Name Directory: from n/a through 1.34.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Jeroen Peters","product":"Name Directory","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"name-directory","versions":[{"version":"0","lessThanOrEqual":"1.34.2","versionType":"custom","status":"affected","changes":[{"at":"1.34.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:57:17.298926Z","id":"CVE-2026-104396","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/name-directory/vulnerability/wordpress-name-directory-plugin-1-34-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104397","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:07.933","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Jeroen Peters","product":"Name Directory","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"name-directory","versions":[{"version":"0","lessThanOrEqual":"1.34.2","versionType":"custom","status":"affected","changes":[{"at":"1.34.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:50:58.678440Z","id":"CVE-2026-104397","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/name-directory/vulnerability/wordpress-name-directory-plugin-1-34-2-arbitrary-shortcode-execution-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104400","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:08.067","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"bPlugins","product":"B Blocks","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"b-blocks","versions":[{"version":"0","lessThanOrEqual":"2.1.8","versionType":"custom","status":"affected","changes":[{"at":"2.1.9","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:59:06.030530Z","id":"CVE-2026-104400","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/b-blocks/vulnerability/wordpress-b-blocks-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104401","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:08.200","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Memberful","product":"Memberful - Membership Plugin","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"memberful-wp","versions":[{"version":"0","lessThanOrEqual":"1.81.2","versionType":"custom","status":"affected","changes":[{"at":"1.82.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:57:27.490739Z","id":"CVE-2026-104401","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-497"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/memberful-wp/vulnerability/wordpress-memberful-membership-plugin-plugin-1-81-2-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104404","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:08.340","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Liquid Web / StellarWP","product":"GiveWP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"give","versions":[{"version":"0","lessThanOrEqual":"4.17.0","versionType":"custom","status":"affected","changes":[{"at":"4.18.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:55:42.796072Z","id":"CVE-2026-104404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104407","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:08.487","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Blubrry Podcasting","product":"PowerPress Podcasting","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"powerpress","versions":[{"version":"0","lessThanOrEqual":"11.17.9","versionType":"custom","status":"affected","changes":[{"at":"11.17.11","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:17:26.857570Z","id":"CVE-2026-104407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-plugin-11-17-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104408","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:08.623","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injection.This issue affects Groundhogg: from n/a through 4.8.3."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Groundhogg","product":"Groundhogg","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"groundhogg","versions":[{"version":"0","lessThanOrEqual":"4.8.3","versionType":"custom","status":"affected","changes":[{"at":"4.9","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:57:52.339075Z","id":"CVE-2026-104408","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-8-3-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104409","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:08.757","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Chill","product":"Image Photo Gallery Final Tiles Grid","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"final-tiles-grid-gallery-lite","versions":[{"version":"0","lessThanOrEqual":"3.6.13","versionType":"custom","status":"affected","changes":[{"at":"3.6.14","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:17:36.833542Z","id":"CVE-2026-104409","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/final-tiles-grid-gallery-lite/vulnerability/wordpress-image-photo-gallery-final-tiles-grid-plugin-3-6-13-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104673","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:08.890","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.14.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Sonaar","product":"MP3 Audio Player for Music, Radio & Podcast by Sonaar","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"mp3-music-player-by-sonaar","versions":[{"version":"0","lessThanOrEqual":"5.14.2","versionType":"custom","status":"affected","changes":[{"at":"5.15","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:46:52.915200Z","id":"CVE-2026-104673","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mp3-music-player-by-sonaar/vulnerability/wordpress-mp3-audio-player-for-music-radio-podcast-by-sonaar-plugin-5-14-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104675","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:09.030","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Liquid Web / StellarWP","product":"Event Tickets","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"event-tickets","versions":[{"version":"0","lessThanOrEqual":"5.30.0","versionType":"custom","status":"affected","changes":[{"at":"5.30.0.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:51:09.283877Z","id":"CVE-2026-104675","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-30-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104706","sourceIdentifier":"vulnerability@ncsc.ch","published":"2026-10-05T09:17:09.167","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus Administration -> View Logs"}],"affected":[{"source":"vulnerability@ncsc.ch","affectedData":[{"vendor":"Mitel","product":"Mitel MiVoice Office 400","defaultStatus":"unknown","platforms":["Linux"],"versions":[{"version":"11.0.96.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vulnerability@ncsc.ch","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Amber","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:15:08.911993Z","id":"CVE-2026-104706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerability@ncsc.ch","type":"Secondary","description":[{"lang":"en","value":"CWE-31"}]}],"references":[{"url":"https://digitalcanion.com/en/security-research/#vendor=mitel&status=cna","source":"vulnerability@ncsc.ch"}]}},{"cve":{"id":"CVE-2026-104805","sourceIdentifier":"vulnerability@ncsc.ch","published":"2026-10-05T09:17:09.380","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration.\n\n\n\n\nThe specific flaw exists within the backup restoration mechanism, which fails to properly validate the paths, file types, integrity, and authenticity of files contained within a restored TGZ archive. The application does not perform file-signature verification before extracting the archive, allowing a specially crafted backup to contain attacker-controlled files.\n\n\n\n\nAn attacker with access to the backup SFTP or other configured repository can therefore provide a malicious TGZ archive that, when restored by the system, may place arbitrary files on the underlying Linux system. Depending on the location and permissions of the extracted files, this behavior can potentially be leveraged to achieve arbitrary code execution with root privileges and compromise the underlying virtual machine.\n\n\n\n\nThe absence of enforced backup passwords further reduces the protection provided by the backup mechanism and may facilitate unauthorized access to the repository."}],"affected":[{"source":"vulnerability@ncsc.ch","affectedData":[{"vendor":"Mitel","product":"Mitel MiVoice Office 400","defaultStatus":"unknown","platforms":["Linux"],"versions":[{"version":"11.0.96.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vulnerability@ncsc.ch","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Amber","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:57:00.814880Z","id":"CVE-2026-104805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerability@ncsc.ch","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-434"},{"lang":"en","value":"CWE-494"}]}],"references":[{"url":"https://digitalcanion.com/en/security-research/#vendor=mitel&status=cna","source":"vulnerability@ncsc.ch"}]}},{"cve":{"id":"CVE-2026-104806","sourceIdentifier":"vulnerability@ncsc.ch","published":"2026-10-05T09:17:09.540","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory.\n\n\n\n\nThe specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to properly validate user-supplied file paths, allowing an attacker to manipulate the requested path and traverse the underlying directory structure.\n\n\n\n\nBy exploiting this vulnerability, an attacker can access and download files located outside the intended system logs directory, including potentially sensitive system and application files."}],"affected":[{"source":"vulnerability@ncsc.ch","affectedData":[{"vendor":"Mitel","product":"Mitel MiVoice Office 400","defaultStatus":"unknown","platforms":["Linux"],"versions":[{"version":"11.0.96.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vulnerability@ncsc.ch","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:L/U:Amber","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"AUTOMATIC","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"LOW","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:50:17.307733Z","id":"CVE-2026-104806","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerability@ncsc.ch","type":"Secondary","description":[{"lang":"en","value":"CWE-31"}]}],"references":[{"url":"https://digitalcanion.com/en/security-research/#vendor=mitel&status=cna","source":"vulnerability@ncsc.ch"}]}},{"cve":{"id":"CVE-2026-104807","sourceIdentifier":"vulnerability@ncsc.ch","published":"2026-10-05T09:17:09.690","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application.\n\n\n\n\nThe specific flaw exists within the web portal listening on TCP port 443, under Configuration → Domains, specifically in the “Description” field. The application fails to properly validate or sanitize user-supplied input before storing and subsequently rendering the field.\n\n\n\n\nBy injecting malicious JavaScript into the Description field, an attacker can modify the content and behavior of the affected page when it is viewed by other users. This could allow an attacker to alter the page's appearance, display attacker-controlled content, or construct convincing phishing scenarios within the application's trusted web context."}],"affected":[{"source":"vulnerability@ncsc.ch","affectedData":[{"vendor":"Mitel","product":"Mitel MiVoice Office 400","defaultStatus":"unknown","platforms":["Linux"],"versions":[{"version":"11.0.96.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vulnerability@ncsc.ch","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:L/U:Amber","baseScore":1.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"AUTOMATIC","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"LOW","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:11:15.358627Z","id":"CVE-2026-104807","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerability@ncsc.ch","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://digitalcanion.com/en/security-research/#vendor=mitel&status=cna","source":"vulnerability@ncsc.ch"}]}},{"cve":{"id":"CVE-2026-104808","sourceIdentifier":"vulnerability@ncsc.ch","published":"2026-10-05T09:17:09.870","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application.\n\n\n\n\nThe specific flaw exists within the web portal listening on TCP port 443, under Configuration → Users → Users List. The vulnerability occurs in the “Microsoft Exchange mailbox” field, which fails to properly validate or sanitize user-supplied input before storing and rendering it.\n\n\n\n\nBy injecting malicious JavaScript into this field, an attacker can cause the payload to execute whenever the affected user properties are accessed. This can prevent access to the affected user properties and result in a denial-of-service condition within the application's user-management functionality."}],"affected":[{"source":"vulnerability@ncsc.ch","affectedData":[{"vendor":"Mitel","product":"Mitel MiVoice Office 400","defaultStatus":"unknown","platforms":["Linux"],"versions":[{"version":"11.0.96.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vulnerability@ncsc.ch","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:L/U:Amber","baseScore":1.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"AUTOMATIC","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"LOW","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:04:14.743968Z","id":"CVE-2026-104808","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerability@ncsc.ch","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://digitalcanion.com/en/security-research/#vendor=mitel&status=cna","source":"vulnerability@ncsc.ch"}]}},{"cve":{"id":"CVE-2026-104809","sourceIdentifier":"vulnerability@ncsc.ch","published":"2026-10-05T09:17:10.007","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine."}],"affected":[{"source":"vulnerability@ncsc.ch","affectedData":[{"vendor":"Mitel","product":"Mitel MiVoice Office 400","defaultStatus":"unknown","platforms":["Linux"],"versions":[{"version":"11.0.96.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vulnerability@ncsc.ch","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Amber","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:53:58.881891Z","id":"CVE-2026-104809","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerability@ncsc.ch","type":"Secondary","description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-426"},{"lang":"en","value":"CWE-427"},{"lang":"en","value":"CWE-494"},{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://digitalcanion.com/en/security-research/#vendor=mitel&status=cna","source":"vulnerability@ncsc.ch"}]}},{"cve":{"id":"CVE-2026-104810","sourceIdentifier":"vulnerability@ncsc.ch","published":"2026-10-05T09:17:10.153","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability.\n\n\n\n\nThe specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management → File Browser, which is affected by a directory traversal vulnerability. By exploiting this vulnerability, an authenticated attacker can access and delete files outside of the intended directory, including files belonging to the Mitel application and the underlying Linux system. Deleting critical system or application files can result in a denial-of-service condition affecting the underlying system."}],"affected":[{"source":"vulnerability@ncsc.ch","affectedData":[{"vendor":"Mitel","product":"Mitel MiVoice Office 400","defaultStatus":"unknown","platforms":["Linux"],"versions":[{"version":"11.0.96.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vulnerability@ncsc.ch","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Amber","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:45:07.682452Z","id":"CVE-2026-104810","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerability@ncsc.ch","type":"Secondary","description":[{"lang":"en","value":"CWE-31"}]}],"references":[{"url":"https://digitalcanion.com/en/security-research/#vendor=mitel&status=cna","source":"vulnerability@ncsc.ch"}]}},{"cve":{"id":"CVE-2026-104811","sourceIdentifier":"vulnerability@ncsc.ch","published":"2026-10-05T09:17:10.290","lastModified":"2026-10-06T15:18:12.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability.\n\n\n\n\nThe specific flaw exists within the Configuration → Services → Music on Hold functionality of the web portal listening on TCP port 443. The application is intended to allow users to upload WAV audio files but fails to properly validate the uploaded file type. An attacker can exploit this behavior to upload a malicious shared object (.so) instead of a WAV file. When the uploaded file is subsequently processed by the affected component, attacker-controlled code is loaded and executed in the context of the affected process. This can result in remote code execution and potentially full compromise of the underlying Linux system."}],"affected":[{"source":"vulnerability@ncsc.ch","affectedData":[{"vendor":"Mitel","product":"Mitel MiVoice Office 400","defaultStatus":"unknown","platforms":["Linux"],"versions":[{"version":"11.0.96.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vulnerability@ncsc.ch","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Amber","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:37:39.945496Z","id":"CVE-2026-104811","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerability@ncsc.ch","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-434"},{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://digitalcanion.com/en/security-research/#vendor=mitel&status=cna","source":"vulnerability@ncsc.ch"}]}},{"cve":{"id":"CVE-2026-105055","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:10.583","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through 1.9.0.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Mailster","product":"WP Mailster","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-mailster","versions":[{"version":"0","lessThanOrEqual":"1.9.0.0","versionType":"custom","status":"affected","changes":[{"at":"1.9.1.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:24:49.985970Z","id":"CVE-2026-105055","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-9-0-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105056","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:10.727","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"impleCode","product":"eCommerce Product Catalog","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ecommerce-product-catalog","versions":[{"version":"0","lessThanOrEqual":"3.6.2","versionType":"custom","status":"affected","changes":[{"at":"3.6.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:17:13.860381Z","id":"CVE-2026-105056","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ecommerce-product-catalog/vulnerability/wordpress-ecommerce-product-catalog-plugin-3-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105060","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:10.863","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through 4.0.4."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Themepoints","product":"Logo Showcase","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"logo-showcase","versions":[{"version":"0","lessThanOrEqual":"4.0.4","versionType":"custom","status":"affected","changes":[{"at":"4.0.5","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:57:32.921071Z","id":"CVE-2026-105060","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/logo-showcase/vulnerability/wordpress-logo-showcase-plugin-4-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105062","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:11.000","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Brandtoss","product":"WP Admin Audit","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-admin-audit","versions":[{"version":"0","lessThanOrEqual":"1.2.17","versionType":"custom","status":"affected","changes":[{"at":"1.2.18","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:46:54.379939Z","id":"CVE-2026-105062","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-admin-audit/vulnerability/wordpress-wp-admin-audit-plugin-1-2-17-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105064","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:11.140","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Parameter Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.22."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Unlimited Elements","product":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates)","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"unlimited-elements-for-elementor","versions":[{"version":"0","lessThanOrEqual":"2.0.22","versionType":"custom","status":"affected","changes":[{"at":"2.0.23","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:56:57.333695Z","id":"CVE-2026-105064","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-470"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-22-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105068","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:11.280","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Pixelite","product":"Events Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"events-manager","versions":[{"version":"0","lessThanOrEqual":"7.4.5","versionType":"custom","status":"affected","changes":[{"at":"7.4.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:56:34.956630Z","id":"CVE-2026-105068","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-5-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105069","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:11.423","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a through 2.0.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nikki Blight","product":"QR Redirector","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"qr-redirector","versions":[{"version":"0","lessThanOrEqual":"2.0.5","versionType":"custom","status":"affected","changes":[{"at":"2.0.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:48:29.849724Z","id":"CVE-2026-105069","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/qr-redirector/vulnerability/wordpress-qr-redirector-plugin-2-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105251","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T09:17:11.563","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/coding/psx_decoder.c of the component VAG File Handler. Performing a manipulation results in out-of-bounds read. The attack is possible to be carried out remotely. The patch is named 4b8316652a30d40f99ad43310bed273fd1f8a7a3. It is suggested to install a patch to address this issue."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"vgmstream","cpes":["cpe:2.3:a:vgmstream:vgmstream:*:*:*:*:*:*:*:*"],"modules":["VAG File Handler"],"versions":[{"version":"r2117","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:14:55.698364Z","id":"CVE-2026-105251","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/vgmstream/vgmstream/","source":"cna@vuldb.com"},{"url":"https://github.com/vgmstream/vgmstream/commit/4b8316652a30d40f99ad43310bed273fd1f8a7a3","source":"cna@vuldb.com"},{"url":"https://github.com/vgmstream/vgmstream/issues/2000","source":"cna@vuldb.com"},{"url":"https://github.com/vgmstream/vgmstream/pull/2001","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105251","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/976281","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413458","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413458/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105253","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T09:17:11.753","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /admin/login1.php. This manipulation of the argument User causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Online Admission System Project","cpes":["cpe:2.3:a:itsourcecode:online_admission_system_project:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:22:45.013920Z","id":"CVE-2026-105253","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/maryhu821/Submit/issues/1","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105253","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977177","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413462","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413462/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105254","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T09:17:11.947","lastModified":"2026-10-07T21:17:10.903","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Online Admission System","cpes":["cpe:2.3:a:itsourcecode:online_admission_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:46:04.630751Z","id":"CVE-2026-105254","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/RestXtra/Submit/issues/1","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105254","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977192","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413463","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413463/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105263","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T09:17:12.130","lastModified":"2026-10-05T14:17:20.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue. The patch is named 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2. It is advisable to upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Shaarli","cpes":["cpe:2.3:a:shaarli:shaarli:*:*:*:*:*:*:*:*"],"modules":["Admin Metadata Endpoint"],"versions":[{"version":"0.16.0","status":"affected"},{"version":"0.16.1","status":"affected"},{"version":"0.16.2","status":"affected"},{"version":"0.16.3","status":"affected"},{"version":"0.16.4","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:21:50.615758Z","id":"CVE-2026-105263","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/shaarli/Shaarli/","source":"cna@vuldb.com"},{"url":"https://github.com/shaarli/Shaarli/commit/8ca4de8e7c932a684481f5fbb1229fe16de1f4d2","source":"cna@vuldb.com"},{"url":"https://github.com/shaarli/Shaarli/releases/tag/v0.16.4","source":"cna@vuldb.com"},{"url":"https://github.com/shaarli/Shaarli/security/advisories/GHSA-85jx-fhrf-q9w7","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105263","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/972906","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413464","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413464/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105284","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T09:17:12.350","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Totolink","product":"A3002MU","cpes":["cpe:2.3:a:totolink:a3002mu:*:*:*:*:*:*:*:*"],"modules":["Authentication Check"],"versions":[{"version":"1.0.0-B20230403.1455","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:19:22.129158Z","id":"CVE-2026-105284","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://gist.github.com/H3rmesk1t/ac6e91a8fba51002be085755c8bf7d43","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105284","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977217","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413465","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413465/cti","source":"cna@vuldb.com"},{"url":"https://www.totolink.net/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19184","sourceIdentifier":"vulnerabilities@zephyrproject.org","published":"2026-10-05T09:17:12.907","lastModified":"2026-10-06T15:27:05.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data->results_length and used it in mcux_gau_adc_read_samples() as the number of uint16_t slots available. Because each conversion result occupies sizeof(uint16_t) bytes, a buffer that was accepted as \"large enough\" could be written with up to twice its size in bytes, so every sample past the buffer's midpoint was written out of bounds.\n\nadc_read() and adc_read_async() are Zephyr system calls. The syscall verifier in drivers/adc/adc_handlers.c only confirms that the caller owns buffer_size writable bytes (K_SYSCALL_MEMORY_WRITE); deciding whether that size is sufficient for the requested channels and extra_samplings is delegated entirely to the driver. On a build with CONFIG_USERSPACE=y, a user-mode thread that has been granted the ADC device object could therefore submit a deliberately half-sized buffer and cause the driver's work-queue handler — which runs in supervisor mode, outside the caller's MPU restrictions — to write ADC conversion results past the end of that buffer, at an address and for a length of the caller's choosing.\n\nThe overrun is bounded by the requested sequence: with sequence->options->extra_samplings set, the sampling loop walks the buffer pointer forward across every sampling, so the total overrun can reach the full size of the supplied buffer (kilobytes for a large extra_samplings). The written words are 16-bit ADC conversion results, so the content is only partially attacker-influenced (via the selected analog input, gain and resolution), but the destination and length are fully controlled — sufficient for kernel memory corruption, a crash, or a userspace-to-kernel privilege escalation. Builds without CONFIG_USERSPACE, or on SoCs other than NXP RW61x with the GAU ADC node enabled, are not exposed to the privilege boundary; there the same defect only causes a silent overflow when the application itself passes an undersized buffer.\n\nThe fix replaces the ad-hoc check with the shared adc_sequence_validate_buffer() helper (validating against num_channels * sizeof(uint16_t)), stores buffer_size / sizeof(uint16_t) in results_length, and corrects the loop bound to a post-decrement so exactly the available number of slots may be written."}],"affected":[{"source":"vulnerabilities@zephyrproject.org","affectedData":[{"vendor":"zephyrproject","product":"zephyr","defaultStatus":"unaffected","collectionURL":"https://github.com/zephyrproject-rtos/zephyr","packageName":"zephyr","programFiles":["drivers/adc/adc_mcux_gau_adc.c"],"programRoutines":[{"name":"mcux_gau_adc_do_read"},{"name":"mcux_gau_adc_read_samples"}],"versions":[{"version":"3.7.0","lessThan":"4.5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"vulnerabilities@zephyrproject.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:23:22.615234Z","id":"CVE-2026-19184","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerabilities@zephyrproject.org","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/82b11958065aa85f8644ddc318ff4a328d1443c8","source":"vulnerabilities@zephyrproject.org"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j86w-mfgw-fxj9","source":"vulnerabilities@zephyrproject.org"}]}},{"cve":{"id":"CVE-2026-19185","sourceIdentifier":"vulnerabilities@zephyrproject.org","published":"2026-10-05T09:17:13.077","lastModified":"2026-10-06T15:27:05.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targets.payloads[] array, but did not validate the per-target data buffers those array elements point at. Each struct i3c_ccc_target_payload carries its own data pointer and data_len, and neither was passed through K_SYSCALL_MEMORY() before the payload was handed to z_impl_i3c_do_ccc() and on to the controller driver. The verifier also operated on the caller's live structure rather than a snapshot, so validated fields could be changed by a second user thread between the check and the driver's use — unlike the sibling z_vrfy_i3c_transfer(), which has always copied its message array first.\n\nThe defect is only present in CONFIG_USERSPACE builds, where drivers/i3c/i3c_handlers.c is compiled. An unprivileged user-mode thread that has been granted access to the I3C controller device object — the ordinary way an application lets a user thread talk to I3C peripherals — can issue a direct CCC whose target payload data pointer names an arbitrary kernel address. Controller drivers dereference that pointer directly (for example drivers/i3c/i3c_mcux.c, drivers/i3c/i3c_cdns.c, drivers/i3c/i3c_stm32.c, drivers/i3c/i3c_npcx.c), using rnw to decide direction.\n\nA read CCC therefore causes the kernel-mode driver to write bus-received bytes into an attacker-chosen kernel address for an attacker-chosen length, and a write CCC transmits kernel memory out onto the I3C bus. The result is an out-of-bounds kernel write plus a kernel memory disclosure, i.e. escalation from a user-mode thread to supervisor privilege, defeating the isolation CONFIG_USERSPACE is meant to provide.\n\nThe fix introduces copy_ccc_and_do(), which snapshots the payload, copies the target array into kernel memory with k_usermode_alloc_from_copy() (bounding num_targets to fewer than 32), validates each per-target buffer with K_SYSCALL_MEMORY() according to rnw, and copies the driver-written num_xfer and err fields back to the caller."}],"affected":[{"source":"vulnerabilities@zephyrproject.org","affectedData":[{"vendor":"zephyrproject","product":"zephyr","defaultStatus":"unaffected","collectionURL":"https://github.com/zephyrproject-rtos/zephyr","packageName":"zephyr","programFiles":["drivers/i3c/i3c_handlers.c"],"programRoutines":[{"name":"z_vrfy_i3c_do_ccc"}],"versions":[{"version":"3.2.0","lessThan":"4.5.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"vulnerabilities@zephyrproject.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:06:01.294641Z","id":"CVE-2026-19185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vulnerabilities@zephyrproject.org","type":"Secondary","description":[{"lang":"en","value":"CWE-822"}]}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/35562f22f40c6d2f31969a31f0a4902e5b067f27","source":"vulnerabilities@zephyrproject.org"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pcrr-29j7-8w57","source":"vulnerabilities@zephyrproject.org"}]}},{"cve":{"id":"CVE-2026-39721","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:13.227","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Starter Templates: from n/a through 4.7.7."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Brainstorm Force","product":"Starter Templates","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"astra-sites","versions":[{"version":"0","lessThanOrEqual":"4.7.7","versionType":"custom","status":"affected","changes":[{"at":"4.7.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:46:49.870581Z","id":"CVE-2026-39721","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/astra-sites/vulnerability/wordpress-starter-templates-plugin-4-7-7-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97071","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T09:17:13.887","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"VillaTheme","product":"CURCY","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-multi-currency","versions":[{"version":"0","lessThanOrEqual":"2.2.17","versionType":"custom","status":"affected","changes":[{"at":"2.2.18","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:17:23.203192Z","id":"CVE-2026-97071","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-682"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-multi-currency/vulnerability/wordpress-curcy-plugin-2-2-17-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105285","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T10:16:38.520","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQos/comment/entry_name leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Totolink","product":"A3002MU","cpes":["cpe:2.3:a:totolink:a3002mu:*:*:*:*:*:*:*:*"],"modules":["QoS Rule Handler"],"versions":[{"version":"1.0.0-B20230403.1455","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:46:31.245020Z","id":"CVE-2026-105285","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://gist.github.com/H3rmesk1t/b68352b011bc2825adc85cf336c25dfb","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105285","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977224","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413466","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413466/cti","source":"cna@vuldb.com"},{"url":"https://www.totolink.net/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105286","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T10:16:41.247","lastModified":"2026-10-07T21:17:11.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub_44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit is now public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Totolink","product":"A3002MU","cpes":["cpe:2.3:a:totolink:a3002mu:*:*:*:*:*:*:*:*"],"modules":["File Upload Handler"],"versions":[{"version":"1.0.0-B20230403.1455","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:46:50.618683Z","id":"CVE-2026-105286","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gist.github.com/H3rmesk1t/b107cde70392e0aff26e8219bae1a181","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105286","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977225","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413467","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413467/cti","source":"cna@vuldb.com"},{"url":"https://www.totolink.net/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105287","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T10:16:41.490","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups[] causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"feelec-yishu","product":"feelcrm-os","cpes":["cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*"],"modules":["getMemberByGroups Endpoint"],"versions":[{"version":"1.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T11:56:12.979898Z","id":"CVE-2026-105287","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/feelec-yishu/feelcrm-os/","source":"cna@vuldb.com"},{"url":"https://github.com/feelec-yishu/feelcrm-os/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105287","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977517","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413468","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413468/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105288","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T10:16:41.713","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"feelec-yishu","product":"feelcrm-os","cpes":["cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*"],"modules":["Crm Endpoint"],"versions":[{"version":"1.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:23:51.130026Z","id":"CVE-2026-105288","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/feelec-yishu/feelcrm-os/","source":"cna@vuldb.com"},{"url":"https://github.com/feelec-yishu/feelcrm-os/issues/2","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105288","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977518","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413469","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413469/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19395","sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","published":"2026-10-05T10:16:41.923","lastModified":"2026-10-06T16:00:36.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device."}],"affected":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","affectedData":[{"vendor":"qt","product":"Qt for MCUs","defaultStatus":"unaffected","modules":["qul"],"versions":[{"version":"2.12.0","lessThan":"2.12.3","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:00:28.733595Z","id":"CVE-2026-19395","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","description":[{"lang":"en","value":"CWE-230"},{"lang":"en","value":"CWE-617"}]}],"references":[{"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-19395:","source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}]}},{"cve":{"id":"CVE-2026-105289","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T11:16:46.617","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customer_form[remark] results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"feelec-yishu","product":"feelcrm-os","cpes":["cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*"],"modules":["Create Customer Endpoint"],"versions":[{"version":"1.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:45:34.235685Z","id":"CVE-2026-105289","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/feelec-yishu/feelcrm-os/","source":"cna@vuldb.com"},{"url":"https://github.com/feelec-yishu/feelcrm-os/issues/3","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105289","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977519","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413470","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413470/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105290","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T11:16:46.807","lastModified":"2026-10-07T21:17:11.417","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"feelec-yishu","product":"feelcrm-os","cpes":["cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*"],"modules":["getCurlData Endpoint"],"versions":[{"version":"1.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:47:46.335492Z","id":"CVE-2026-105290","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/feelec-yishu/feelcrm-os/","source":"cna@vuldb.com"},{"url":"https://github.com/feelec-yishu/feelcrm-os/issues/4","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105290","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977520","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413471","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413471/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105291","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T11:16:46.983","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"feelec-yishu","product":"feelcrm-os","cpes":["cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*"],"modules":["Department Search Endpoint"],"versions":[{"version":"1.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T10:59:54.344922Z","id":"CVE-2026-105291","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/feelec-yishu/feelcrm-os/","source":"cna@vuldb.com"},{"url":"https://github.com/feelec-yishu/feelcrm-os/issues/5","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105291","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977524","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413472","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413472/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-39763","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T11:16:53.260","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through 4.0.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Deepak Anand","product":"WP Dummy Content Generator","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-dummy-content-generator","versions":[{"version":"0","lessThanOrEqual":"4.0.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:44:40.758416Z","id":"CVE-2026-39763","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-dummy-content-generator/vulnerability/wordpress-wp-dummy-content-generator-plugin-4-0-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-59782","sourceIdentifier":"security@zabbix.com","published":"2026-10-05T11:16:59.360","lastModified":"2026-10-06T15:27:05.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator."}],"affected":[{"source":"security@zabbix.com","affectedData":[{"vendor":"Zabbix","product":"Zabbix","defaultStatus":"unknown","modules":["Server","Proxy"],"repo":"https://git.zabbix.com/","versions":[{"version":"6.0.0","lessThanOrEqual":"6.0.47","versionType":"git","status":"affected","changes":[{"at":"6.0.48","status":"unaffected"}]},{"version":"7.0.0","lessThanOrEqual":"7.0.28","versionType":"git","status":"affected","changes":[{"at":"7.0.29","status":"unaffected"}]},{"version":"7.4.0","lessThanOrEqual":"7.4.12","versionType":"git","status":"affected","changes":[{"at":"7.4.13","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@zabbix.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T11:52:57.407878Z","id":"CVE-2026-59782","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@zabbix.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-28193","source":"security@zabbix.com"}]}},{"cve":{"id":"CVE-2026-59783","sourceIdentifier":"security@zabbix.com","published":"2026-10-05T11:16:59.513","lastModified":"2026-10-06T15:27:05.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability. This only affects deployments where MySQL/MariaDB database is used as the Zabbix database."}],"affected":[{"source":"security@zabbix.com","affectedData":[{"vendor":"Zabbix","product":"Zabbix","defaultStatus":"unknown","modules":["Server","Proxy"],"repo":"https://git.zabbix.com/","versions":[{"version":"7.0.0","lessThanOrEqual":"7.0.28","versionType":"git","status":"affected","changes":[{"at":"7.0.29","status":"unaffected"}]},{"version":"7.4.0","lessThanOrEqual":"7.4.12","versionType":"git","status":"affected","changes":[{"at":"7.4.13","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@zabbix.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T11:46:36.816142Z","id":"CVE-2026-59783","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@zabbix.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-28194","source":"security@zabbix.com"}]}},{"cve":{"id":"CVE-2026-59785","sourceIdentifier":"security@zabbix.com","published":"2026-10-05T11:16:59.667","lastModified":"2026-10-06T15:27:05.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it."}],"affected":[{"source":"security@zabbix.com","affectedData":[{"vendor":"Zabbix","product":"Zabbix","defaultStatus":"unknown","modules":["Frontend"],"repo":"https://git.zabbix.com/","versions":[{"version":"6.0.0","lessThanOrEqual":"6.0.47","versionType":"git","status":"affected","changes":[{"at":"6.0.48","status":"unaffected"}]},{"version":"7.0.0","lessThanOrEqual":"7.0.28","versionType":"git","status":"affected","changes":[{"at":"7.0.29","status":"unaffected"}]},{"version":"7.4.0","lessThanOrEqual":"7.4.12","versionType":"git","status":"affected","changes":[{"at":"7.4.13","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@zabbix.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T11:41:31.643986Z","id":"CVE-2026-59785","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@zabbix.com","type":"Secondary","description":[{"lang":"en","value":"CWE-204"}]}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-28195","source":"security@zabbix.com"}]}},{"cve":{"id":"CVE-2026-59786","sourceIdentifier":"security@zabbix.com","published":"2026-10-05T11:16:59.807","lastModified":"2026-10-06T15:27:05.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity."}],"affected":[{"source":"security@zabbix.com","affectedData":[{"vendor":"Zabbix","product":"Zabbix","defaultStatus":"unknown","modules":["Server","Proxy"],"repo":"https://git.zabbix.com/","versions":[{"version":"7.0.0","lessThanOrEqual":"7.0.28","versionType":"git","status":"affected","changes":[{"at":"7.0.29","status":"unaffected"}]},{"version":"7.4.0","lessThanOrEqual":"7.4.12","versionType":"git","status":"affected","changes":[{"at":"7.4.13","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@zabbix.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T11:25:11.807987Z","id":"CVE-2026-59786","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@zabbix.com","type":"Secondary","description":[{"lang":"en","value":"CWE-940"}]}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-28196","source":"security@zabbix.com"}]}},{"cve":{"id":"CVE-2026-59787","sourceIdentifier":"security@zabbix.com","published":"2026-10-05T11:16:59.953","lastModified":"2026-10-06T15:27:05.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity."}],"affected":[{"source":"security@zabbix.com","affectedData":[{"vendor":"Zabbix","product":"Zabbix","defaultStatus":"unknown","modules":["Server","Proxy"],"repo":"https://git.zabbix.com/","versions":[{"version":"6.0.0","lessThanOrEqual":"6.0.47","versionType":"git","status":"affected","changes":[{"at":"6.0.48","status":"unaffected"}]},{"version":"7.0.0","lessThanOrEqual":"7.0.28","versionType":"git","status":"affected","changes":[{"at":"7.0.29","status":"unaffected"}]},{"version":"7.4.0","lessThanOrEqual":"7.4.12","versionType":"git","status":"affected","changes":[{"at":"7.4.13","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@zabbix.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T11:23:21.868482Z","id":"CVE-2026-59787","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@zabbix.com","type":"Secondary","description":[{"lang":"en","value":"CWE-143"}]}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-28197","source":"security@zabbix.com"}]}},{"cve":{"id":"CVE-2026-59788","sourceIdentifier":"security@zabbix.com","published":"2026-10-05T11:17:00.113","lastModified":"2026-10-06T15:27:05.657","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent."}],"affected":[{"source":"security@zabbix.com","affectedData":[{"vendor":"Zabbix","product":"Zabbix","defaultStatus":"unknown","modules":["Frontend"],"repo":"https://git.zabbix.com/","versions":[{"version":"7.4.0","lessThanOrEqual":"7.4.11","versionType":"git","status":"affected","changes":[{"at":"7.4.12","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@zabbix.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T11:22:54.202007Z","id":"CVE-2026-59788","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@zabbix.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://support.zabbix.com/browse/ZBX-28198","source":"security@zabbix.com"}]}},{"cve":{"id":"CVE-2026-94669","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T11:17:01.787","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP ManageNinja LLC","product":"Fluent Forms Pro Add On Pack","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"fluentformpro","versions":[{"version":"0","lessThanOrEqual":"6.2.13","versionType":"custom","status":"affected","changes":[{"at":"6.2.14","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T11:22:32.654082Z","id":"CVE-2026-94669","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/fluentformpro/vulnerability/wordpress-fluent-forms-pro-add-on-pack-plugin-6-2-13-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103684","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T12:17:07.670","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Arraytics","product":"WP Event Solution","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-event-solution","versions":[{"version":"0","lessThanOrEqual":"4.1.25","versionType":"custom","status":"affected","changes":[{"at":"4.1.26","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:56:12.532235Z","id":"CVE-2026-103684","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-25-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105073","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T12:17:09.040","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Arraytics","product":"WP Event Solution","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-event-solution","versions":[{"version":"0","lessThanOrEqual":"4.1.25","versionType":"custom","status":"affected","changes":[{"at":"4.1.26","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:48:21.743216Z","id":"CVE-2026-105073","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-497"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-25-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-105307","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T12:17:09.380","lastModified":"2026-10-05T16:17:12.323","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Casdoor","cpes":["cpe:2.3:a:casdoor:casdoor:*:*:*:*:*:*:*:*"],"modules":["API Endpoint"],"versions":[{"version":"3.161.0","status":"affected"},{"version":"3.161.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:25:21.379111Z","id":"CVE-2026-105307","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-105307","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/951430","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413512","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413512/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105396","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-05T12:17:09.583","lastModified":"2026-10-05T16:00:27.123","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"heymrun","product":"heym","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.0.112","versionType":"semver","status":"affected"},{"version":"0.0.112","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:13:02.577108Z","id":"CVE-2026-105396","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-6rv3-wh25-7pg5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/heym-before-0.0.112-hitl-review-token-leak-via-spoofable-origin-header","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-39783","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T12:17:09.740","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP SYNTEX","product":"Polylang","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"polylang","versions":[{"version":"0","lessThanOrEqual":"3.8.7","versionType":"custom","status":"affected","changes":[{"at":"3.8.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:46:48.245086Z","id":"CVE-2026-39783","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/polylang/vulnerability/wordpress-polylang-plugin-3-8-7-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-63266","sourceIdentifier":"security@documentfoundation.org","published":"2026-10-05T12:17:10.577","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory."}],"affected":[{"source":"security@documentfoundation.org","affectedData":[{"vendor":"The Document Foundation","product":"LibreOffice","defaultStatus":"unknown","versions":[{"version":"26.2","lessThan":"< 26.2.5","versionType":"26.2 series","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@documentfoundation.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:42:40.333248Z","id":"CVE-2026-63266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@documentfoundation.org","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-63266","source":"security@documentfoundation.org"}]}},{"cve":{"id":"CVE-2026-63267","sourceIdentifier":"security@documentfoundation.org","published":"2026-10-05T12:17:10.713","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet."}],"affected":[{"source":"security@documentfoundation.org","affectedData":[{"vendor":"The Document Foundation","product":"LibreOffice","defaultStatus":"unknown","versions":[{"version":"26.2","lessThan":"< 26.2.5","versionType":"26.2 series","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@documentfoundation.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:41:30.603476Z","id":"CVE-2026-63267","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@documentfoundation.org","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-63267","source":"security@documentfoundation.org"}]}},{"cve":{"id":"CVE-2026-63268","sourceIdentifier":"security@documentfoundation.org","published":"2026-10-05T12:17:10.853","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded."}],"affected":[{"source":"security@documentfoundation.org","affectedData":[{"vendor":"The Document Foundation","product":"LibreOffice","defaultStatus":"unknown","versions":[{"version":"26.2","lessThan":"< 26.2.5","versionType":"26.2 series","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@documentfoundation.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:41:03.388017Z","id":"CVE-2026-63268","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@documentfoundation.org","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-63268","source":"security@documentfoundation.org"}]}},{"cve":{"id":"CVE-2026-63269","sourceIdentifier":"security@documentfoundation.org","published":"2026-10-05T12:17:10.980","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control."}],"affected":[{"source":"security@documentfoundation.org","affectedData":[{"vendor":"The Document Foundation","product":"LibreOffice","defaultStatus":"unknown","versions":[{"version":"26.2","lessThan":"< 26.2.5","versionType":"26.2 series","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@documentfoundation.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:40:39.717342Z","id":"CVE-2026-63269","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@documentfoundation.org","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-63269","source":"security@documentfoundation.org"}]}},{"cve":{"id":"CVE-2026-63270","sourceIdentifier":"security@documentfoundation.org","published":"2026-10-05T12:17:11.113","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL. XForms instance data and the Calc csv and sql data providers still reached the expansion. In fixed versions these places refuse URLs with internal schemes when the URL comes from the document."}],"affected":[{"source":"security@documentfoundation.org","affectedData":[{"vendor":"The Document Foundation","product":"LibreOffice","defaultStatus":"unknown","versions":[{"version":"26.2","lessThan":"< 26.2.5","versionType":"26.2 series","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@documentfoundation.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:40:06.243261Z","id":"CVE-2026-63270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@documentfoundation.org","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-63270","source":"security@documentfoundation.org"}]}},{"cve":{"id":"CVE-2026-63277","sourceIdentifier":"security@documentfoundation.org","published":"2026-10-05T12:17:11.253","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL."}],"affected":[{"source":"security@documentfoundation.org","affectedData":[{"vendor":"The Document Foundation","product":"LibreOffice","defaultStatus":"unknown","versions":[{"version":"26.2","lessThan":"< 26.2.5","versionType":"26.2 series","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@documentfoundation.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T12:43:08.481980Z","id":"CVE-2026-63277","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@documentfoundation.org","type":"Secondary","description":[{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2026-63277","source":"security@documentfoundation.org"}]}},{"cve":{"id":"CVE-2026-105315","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T13:16:52.823","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"django-haystack","cpes":["cpe:2.3:a:django-haystack:django-haystack:*:*:*:*:*:*:*:*"],"modules":["more_like_this Template Tag Handler"],"versions":[{"version":"3.0","status":"affected"},{"version":"3.1","status":"affected"},{"version":"3.2","status":"affected"},{"version":"3.3.0","status":"affected"},{"version":"3.4.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"MULTIPLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T13:27:10.308923Z","id":"CVE-2026-105315","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-95"}]}],"references":[{"url":"https://github.com/django-haystack/django-haystack/","source":"cna@vuldb.com"},{"url":"https://github.com/django-haystack/django-haystack/commit/eb05f193c9771a68dcc8cfac6674a0d48a52ee9d","source":"cna@vuldb.com"},{"url":"https://github.com/django-haystack/django-haystack/releases/tag/v3.4.0","source":"cna@vuldb.com"},{"url":"https://github.com/django-haystack/django-haystack/security/advisories/GHSA-r3hx-x5rh-p9vv","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105315","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/978642","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413523","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413523/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-77802","sourceIdentifier":"security@progress.com","published":"2026-10-05T13:16:54.293","lastModified":"2026-10-06T18:16:56.153","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while Fiddler frames the request body using only the first Content-Length value. A local threat actor with low privileges who is able to send requests through the same Fiddler proxy instance as another user can exploit this desynchronization against a non-RFC-9110-compliant origin server that keeps the connection alive to smuggle an additional request. Because Fiddler returns the server connection to its pipe pool after reading only the first response, the unread smuggled response remains buffered on the socket and is served to the next session that reuses that connection, allowing the attacker to poison responses delivered to other users and to obtain responses intended for them."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"Progress® Telerik® Fiddler® Classic","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"1.0.0","lessThan":"6.0.20262.10021","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:50:58.548832Z","id":"CVE-2026-77802","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-444"}]}],"references":[{"url":"https://docs.telerik.com/fiddler/knowledge-base/kb-security-http-request-smuggling-cve-2026-77802","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-77803","sourceIdentifier":"security@progress.com","published":"2026-10-05T13:16:54.453","lastModified":"2026-10-06T18:16:56.270","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"Progress® Telerik® Fiddler® Classic","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"1.0.0","lessThan":"6.0.20262.10021","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":3.6,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:50:20.748709Z","id":"CVE-2026-77803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-444"}]}],"references":[{"url":"https://docs.telerik.com/fiddler/knowledge-base/kb-security-front-end-desynchronization-cve-2026-77803","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-77804","sourceIdentifier":"security@progress.com","published":"2026-10-05T13:16:54.590","lastModified":"2026-10-06T18:16:56.393","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in the installation of the HTTPS interception root certificate into the Local Computer certificate store. Fiddler writes the certificate to a temporary file in a user-writable location and then launches the external TrustCert helper application, which elevates and imports the certificate from that file. A local threat actor with low privileges who replaces the temporary file between the time it is written and the time the elevated helper reads it can cause an attacker-supplied root certificate to be installed in the Local Computer Trusted Root Certification Authorities store, enabling subsequent interception and modification of TLS-protected traffic on the machine. Successful exploitation requires the user to initiate the certificate trust operation and approve the elevation prompt."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"Progress® Telerik® Fiddler® Classic","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"1.0.0","lessThan":"6.0.20262.10021","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:49:19.748248Z","id":"CVE-2026-77804","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"references":[{"url":"https://docs.telerik.com/fiddler/knowledge-base/kb-security-root-certificate-installation-toctou-cve-2026-77804","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-77805","sourceIdentifier":"security@progress.com","published":"2026-10-05T13:16:54.740","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"Progress® Telerik® Fiddler® Classic","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"1.0.0","lessThan":"6.0.20262.10021","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":7.9,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.5,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:25:58.985097Z","id":"CVE-2026-77805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://docs.telerik.com/fiddler/knowledge-base/kb-security-weak-executable-signature-verification-cve-2026-77805","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-92931","sourceIdentifier":"security@progress.com","published":"2026-10-05T14:17:21.323","lastModified":"2026-10-06T18:16:58.430","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information."}],"affected":[{"source":"security@progress.com","affectedData":[{"vendor":"Progress Software","product":"@progress/sitefinity-nextjs-sdk","defaultStatus":"unaffected","versions":[{"version":"15.1.8326","lessThan":"15.4.8638","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T03:55:57.764065Z","id":"CVE-2026-92931","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@progress.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://community.progress.com/s/article/Sitefinity-Critical-Security-Advisory-for-Addressing-Security-Vulnerabilities-in-Next-js-September-2026","source":"security@progress.com"}]}},{"cve":{"id":"CVE-2026-105421","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T15:17:21.043","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooCommerce: from n/a through 2.2.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Kit","product":"Kit (formerly ConvertKit) for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"convertkit-for-woocommerce","versions":[{"version":"0","lessThanOrEqual":"2.2.0","versionType":"custom","status":"affected","changes":[{"at":"2.2.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:38:10.350937Z","id":"CVE-2026-105421","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/convertkit-for-woocommerce/vulnerability/wordpress-kit-formerly-convertkit-for-woocommerce-plugin-2-2-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-79820","sourceIdentifier":"security-alert@hpe.com","published":"2026-10-05T15:17:22.290","lastModified":"2026-10-06T15:15:48.310","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware."}],"affected":[{"source":"security-alert@hpe.com","affectedData":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"HPE Integrated Lights-Out (iLO) 7","defaultStatus":"unaffected","versions":[{"version":"1.25.00","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-alert@hpe.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:18:55.318106Z","id":"CVE-2026-79820","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf05163en_us&docLocale=en_US","source":"security-alert@hpe.com"}]}},{"cve":{"id":"CVE-2026-88391","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T15:17:22.697","lastModified":"2026-10-06T16:08:27.613","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary system commands via CREATE ALIAS (pre-auth RCE)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:00:56.038948Z","id":"CVE-2026-88391","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/fangtang7/CVE/blob/main/Northstar%20H2/rce.md","source":"cve@mitre.org"},{"url":"https://github.com/fangtang7/CVE/blob/main/Northstar%20H2/rce.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88392","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T15:17:22.857","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:28:53.880386Z","id":"CVE-2026-88392","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/fangtang7/CVE/blob/main/Unimall/file.md","source":"cve@mitre.org"},{"url":"https://github.com/fangtang7/CVE/blob/main/Unimall/file.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88394","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T15:17:22.997","lastModified":"2026-10-06T23:16:56.357","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into storage_path($file) without any path normalization or directory boundary check, so directory traversal (../) escapes the storage/ directory and response()->download() streams any file readable by the web server process."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T22:07:51.088277Z","id":"CVE-2026-88394","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/fangtang7/CVE/blob/main/WookTeam/fileread.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-89039","sourceIdentifier":"security@grafana.com","published":"2026-10-05T15:17:23.130","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory (path traversal). The working-directory restriction applied to '@'-prefixed paths can also be bypassed with a symbolic link inside the working directory that points outside it."}],"affected":[{"source":"security@grafana.com","affectedData":[{"vendor":"Grafana","product":"mcp-k6","defaultStatus":"unaffected","versions":[{"version":"0.3.0","lessThan":"0.7.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@grafana.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:14:33.272676Z","id":"CVE-2026-89039","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@grafana.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-424"}]}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-89039","source":"security@grafana.com"}]}},{"cve":{"id":"CVE-2026-102426","sourceIdentifier":"security@joomla.org","published":"2026-10-05T16:17:04.017","lastModified":"2026-10-14T18:53:32.297","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId> request parameter, split on the delimiter \"l-r\", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content. An unauthenticated attacker reflects arbitrary HTML or JavaScript into the rendered page through a crafted dc_filter_<fieldId> value."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomshaper.com","product":"SP Page Builder (Pro) extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"3.0.0 - 5.6.1p2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T16:27:41.657589Z","id":"CVE-2026-102426","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ollyo:sp_page_builder:*:*:*:*:pro:joomla\\!:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"5.6.1","matchCriteriaId":"1289111B-077B-4767-8E5F-CF2CBA00D851"},{"vulnerable":true,"criteria":"cpe:2.3:a:ollyo:sp_page_builder:5.6.1:-:*:*:pro:joomla\\!:*:*","matchCriteriaId":"5AE15D3A-2790-4CC4-AD23-AC047A987DFE"}]}]}],"references":[{"url":"https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-102428","sourceIdentifier":"security@joomla.org","published":"2026-10-05T16:17:04.177","lastModified":"2026-10-14T18:52:52.567","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"ordasoft.com","product":"OrdaSoft Joomla CCK","defaultStatus":"unaffected","packageName":"com_os_cck","versions":[{"version":"1.0.0-8.3.15","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T16:29:04.691048Z","id":"CVE-2026-102428","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ordasoft:joomla_cck:*:*:*:*:*:joomla\\!:*:*","versionEndExcluding":"8.3.16","matchCriteriaId":"5777D1F2-60F5-4741-9C6C-95842E017E14"}]}]}],"references":[{"url":"https://www.ordasoft.com/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-102775","sourceIdentifier":"security@joomla.org","published":"2026-10-05T16:17:04.317","lastModified":"2026-10-14T18:51:41.080","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"phoca.cz","product":"Phoca Cart extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"5.0.0-6.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T16:29:31.525858Z","id":"CVE-2026-102775","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:phoca:phoca_cart:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"5.0.0","versionEndIncluding":"6.1.8","matchCriteriaId":"D86DD1DA-6A4F-4D61-ABFF-092E2ABA24ED"}]}]}],"references":[{"url":"https://www.phoca.cz/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-102776","sourceIdentifier":"security@joomla.org","published":"2026-10-05T16:17:04.453","lastModified":"2026-10-14T18:48:46.437","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status and watermark; putting an event into the shop or taking it out; choosing the main image of an event and whether an image is shown only as the main image; and sorting the images of an event. A prepared page on another web site could trigger them in the name of a logged in administrator and change those settings and flags. Nothing can be deleted or read this way; orders are not affected."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"svenbluege.de","product":"Event Gallery for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-6.6.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T16:29:57.828398Z","id":"CVE-2026-102776","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:svenbluege:event_gallery:*:*:*:*:*:joomla\\!:*:*","versionEndExcluding":"6.6.0","matchCriteriaId":"EB62E48A-68D2-472E-A2EA-C7B6B4B6A7C6"}]}]}],"references":[{"url":"https://www.svenbluege.de/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-102778","sourceIdentifier":"security@joomla.org","published":"2026-10-05T16:17:04.593","lastModified":"2026-10-14T18:48:30.587","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the share mini page of the front end) can link the article the image was shared from when the option \"Share article links\" is on. It took the address of the article from the shared link and printed it into the page without checking or escaping it; with the link type \"Image Page with Redirect\" it followed the address at once. A prepared link could therefore run a script in the page, in the session of the visitor who opened it, or send the visitor to another web site. Nothing on the server is changed or read by the server."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"svenbluege.de","product":"Event Gallery for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-6.5.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T16:28:08.594258Z","id":"CVE-2026-102778","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-601"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:svenbluege:event_gallery:*:*:*:*:*:joomla\\!:*:*","versionEndExcluding":"6.6.0","matchCriteriaId":"EB62E48A-68D2-472E-A2EA-C7B6B4B6A7C6"}]}]}],"references":[{"url":"https://www.svenbluege.de/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-102780","sourceIdentifier":"security@joomla.org","published":"2026-10-05T16:17:04.730","lastModified":"2026-10-14T18:48:03.227","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created_by`."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomlafry.com","product":"TF Content for Joomla","defaultStatus":"unaffected","versions":[{"version":"2.9.0-2.9.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T16:28:37.434467Z","id":"CVE-2026-102780","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-915"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:techfry:tf_content:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"2.9.0","versionEndIncluding":"2.9.4","matchCriteriaId":"E2DEE616-0DE1-4BAF-9318-065E9A3BDC17"}]}]}],"references":[{"url":"https://www.joomlafry.com/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-104890","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T16:17:06.270","lastModified":"2026-10-07T21:17:09.367","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types, allowing the same code-execution impact where the web server executes uploaded files. This issue is fixed in version 7.3.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Kunstmaan","product":"KunstmaanBundlesCMS","versions":[{"version":"< 7.3.1","status":"affected"}]},{"vendor":"kunstmaan","product":"bundles-cms","versions":[{"version":"< 7.3.1","status":"affected"}]},{"vendor":"kunstmaan","product":"media-bundle","versions":[{"version":"< 7.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:50:41.475759Z","id":"CVE-2026-104890","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/Kunstmaan/KunstmaanBundlesCMS/commit/1bbdfdeac8e7e91506b1a9271360b9b68d7690d3","source":"security-advisories@github.com"},{"url":"https://github.com/Kunstmaan/KunstmaanBundlesCMS/releases/tag/7.3.2","source":"security-advisories@github.com"},{"url":"https://github.com/Kunstmaan/KunstmaanBundlesCMS/security/advisories/GHSA-p279-5wcv-45vq","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-104891","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T16:17:06.447","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credential.source, checked whether that public address met configured on-chain conditions, and returned a successful free-access receipt without invoking the wrapped payment verifier or proving that the caller controlled the wallet. An unauthenticated attacker could name any qualifying wallet and obtain content that should require payment, and cached grants could be reused for the configured cache lifetime. The corrected packages prevent free-access authorization unless payer control has been established. These issues are fixed in @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"douglasborthwick-crypto","product":"mppx-condition-gate","versions":[{"version":"< b1d9935a57ba6d32da49eead1bfb459ad0cd55ab","status":"affected"}]},{"vendor":"@insumermodel","product":"mppx-condition-gate","versions":[{"version":"< 3.0.0","status":"affected"}]},{"vendor":"@insumermodel","product":"mppx-token-gate","versions":[{"version":"< 1.0.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:53:07.101346Z","id":"CVE-2026-104891","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/insumerapi/mppx-condition-gate/commit/b1d9935a57ba6d32da49eead1bfb459ad0cd55ab","source":"security-advisories@github.com"},{"url":"https://github.com/insumerapi/mppx-condition-gate/commit/ec43a2fcd443a0fa102b6d4203abed2b785bd954","source":"security-advisories@github.com"},{"url":"https://github.com/insumerapi/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-104892","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T16:17:06.620","lastModified":"2026-10-05T17:17:10.543","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T16:21:22.547515Z","id":"CVE-2026-104892","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-256"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9148","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-r5p8-cj3q-38cc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105329","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T16:17:12.460","lastModified":"2026-10-07T21:17:11.587","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in TallCMS up to 4.8.0. This affects an unknown function of the file packages/tallcms/cms/src/Filament/Pages/ThemeManager.php of the component PluginManager. Executing a manipulation can lead to code injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called fdc18f4c6a36134f8986ca1d7e4e97092e3deb93. It is best practice to apply a patch to resolve this issue."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"TallCMS","cpes":["cpe:2.3:a:tallcms:tallcms:*:*:*:*:*:*:*:*"],"modules":["PluginManager"],"versions":[{"version":"4.0","status":"affected"},{"version":"4.1","status":"affected"},{"version":"4.2","status":"affected"},{"version":"4.3","status":"affected"},{"version":"4.4","status":"affected"},{"version":"4.5","status":"affected"},{"version":"4.6","status":"affected"},{"version":"4.7","status":"affected"},{"version":"4.8.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:49:09.058426Z","id":"CVE-2026-105329","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/beegoodit/tallcms/commit/fdc18f4c6a36134f8986ca1d7e4e97092e3deb93","source":"cna@vuldb.com"},{"url":"https://github.com/tallcms/tallcms/","source":"cna@vuldb.com"},{"url":"https://github.com/tallcms/tallcms/issues/122","source":"cna@vuldb.com"},{"url":"https://github.com/tallcms/tallcms/pull/124","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105329","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/979800","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413543","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413543/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105397","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-05T16:17:12.650","lastModified":"2026-10-07T21:17:11.907","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ThimPress","product":"LearnPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.4.9.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:48:25.231345Z","id":"CVE-2026-105397","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/LearnPress/learnpress/commit/9db279c0d9fd3993430bb9af158658282e9bcee1","source":"disclosure@vulncheck.com"},{"url":"https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/assets/src/apps/js/frontend/quiz/components/questions/question.js","source":"disclosure@vulncheck.com"},{"url":"https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/Ajax/EditQuestionAjax.php","source":"disclosure@vulncheck.com"},{"url":"https://wordpress.org/plugins/learnpress/","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/learnpress-wordpress-plugin-through-4.4.9.1-stored-xss-via-quiz-question-hint-and-explanation","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-37719","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T16:17:13.243","lastModified":"2026-10-06T16:17:07.487","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:46:47.777993Z","id":"CVE-2026-37719","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"http://dormakaba.com","source":"cve@mitre.org"},{"url":"https://assets.ctfassets.net/y0dk4vkszqeh/7nkbvO1MxCI5nOhzwDMCF9/173fdc4ceb38e4b9b853f79df6ad44d0/DKSA-26-31-031_evolo_Service_1.pdf","source":"cve@mitre.org"},{"url":"https://www.dormakabagroup.com/en/security-advisories","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-88393","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T16:17:16.830","lastModified":"2026-10-06T18:16:58.060","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which executes eval(\"\\$array = $data;\") whenever the decoded string starts with array. An attacker can inject arbitrary PHP code into the eval call and achieve RCE."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:58:03.989439Z","id":"CVE-2026-88393","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/fangtang7/CVE/blob/main/WookTeam/rce.md","source":"cve@mitre.org"},{"url":"https://github.com/fangtang7/CVE/blob/main/WookTeam/rce.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88395","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T16:17:16.957","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:44:23.857033Z","id":"CVE-2026-88395","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/fangtang7/CVE/blob/main/GouGuOA/sql.md","source":"cve@mitre.org"},{"url":"https://github.com/fangtang7/CVE/blob/main/GouGuOA/sql.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88396","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T16:17:17.080","lastModified":"2026-10-06T23:16:56.530","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T22:11:47.446872Z","id":"CVE-2026-88396","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/fangtang7/CVE/blob/main/ApiAdmin/rce.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-88397","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T16:17:17.220","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:02:54.797628Z","id":"CVE-2026-88397","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/fangtang7/CVE/blob/main/ApiAdmin/sql.md","source":"cve@mitre.org"},{"url":"https://github.com/fangtang7/CVE/blob/main/ApiAdmin/sql.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-102282","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:08.110","lastModified":"2026-10-07T21:17:07.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker can therefore produce an extracted binary with mode `04755`. When extraction runs as root (the default posture in Docker builds, CI runners, and privileged install steps — the exact environments where this flag is used), the resulting root-owned setuid file is executed later by a lesser-privileged user, turning the attacker's code into a root execution. Version 0.6.1 fixes the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"cthackers","product":"adm-zip","versions":[{"version":"< 0.6.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:53:29.301313Z","id":"CVE-2026-102282","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://github.com/cthackers/adm-zip/commit/6a63c339b83c52915483efacda517660a7a7bf87","source":"security-advisories@github.com"},{"url":"https://github.com/cthackers/adm-zip/releases/tag/v0.6.1","source":"security-advisories@github.com"},{"url":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44","source":"security-advisories@github.com"},{"url":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-102777","sourceIdentifier":"security@joomla.org","published":"2026-10-05T17:17:09.753","lastModified":"2026-10-14T18:46:34.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos account. The task took the address to fetch from the request without checking it and asked for no form token. A prepared page on another web site could therefore make the server send the access token of the account to any address, or fetch addresses inside the server's network, in the name of a logged in administrator; a back-end user with the permission \"Manage\" could do the same directly. The token is valid for about an hour and reaches what the picker session of the account reaches."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"svenbluege.de","product":"Event Gallery for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-6.5.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:00:58.185242Z","id":"CVE-2026-102777","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:svenbluege:event_gallery:*:*:*:*:*:joomla\\!:*:*","versionEndExcluding":"6.6.0","matchCriteriaId":"EB62E48A-68D2-472E-A2EA-C7B6B4B6A7C6"}]}]}],"references":[{"url":"https://www.svenbluege.de/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-102779","sourceIdentifier":"security@joomla.org","published":"2026-10-05T17:17:10.040","lastModified":"2026-10-16T20:47:22.590","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomlafry.com","product":"TF Content for Joomla","defaultStatus":"unaffected","versions":[{"version":"2.9.0-2.9.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:02:50.389864Z","id":"CVE-2026-102779","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:techfry:tf_content:*:*:*:*:*:joomla\\!:*:*","versionStartIncluding":"2.9.0","versionEndIncluding":"2.9.4","matchCriteriaId":"E2DEE616-0DE1-4BAF-9318-065E9A3BDC17"}]}]}],"references":[{"url":"https://www.joomlafry.com/","source":"security@joomla.org","tags":["Product"]}]}},{"cve":{"id":"CVE-2026-104893","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:10.650","lastModified":"2026-10-06T18:16:43.207","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows the user to modify the token's allowed_rate_limit field without server-side validation or a maximum value. A user can raise the limit arbitrarily and bypass intended API rate-limiting controls, enabling high-volume automated requests, backend resource abuse, and possible resource exhaustion. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:33:58.706981Z","id":"CVE-2026-104893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9148","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-xfgr-2x3f-g2cf","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-104894","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:10.810","lastModified":"2026-10-05T19:17:15.013","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:33:43.902074Z","id":"CVE-2026-104894","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/81d9873d7f1cf1d1252ed53c12dd33696be73a89","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9269","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-x5c5-hmvm-94v9","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-x5c5-hmvm-94v9","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104955","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:10.970","lastModified":"2026-10-07T21:17:09.583","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/ to change another user's project role. The role-update logic blocks only a new role higher than the requester's role, so assigning the equal Member role bypasses the insufficient validation and promotes a Project Guest with role 5 to Member without Project Admin approval. This unauthorized promotion grants the guest the additional project capabilities associated with the Member role and allows a regular member to bypass project governance controls. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:51:39.176412Z","id":"CVE-2026-104955","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/4c1bdd1d625fa3f1141e8af9c15423946472069e","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9014","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-x63v-p7wc-47x4","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-x63v-p7wc-47x4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104956","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:11.143","lastModified":"2026-10-05T20:17:09.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by F(field), .values(field), .order_by(field), and Window partition_by operations. An anonymous attacker can supply arbitrary field paths that trigger an unhandled FieldError or KeyError and an HTTP 500 response, or force the ORM to resolve __-separated relational paths as a blind traversal oracle. This is the same field-name injection class addressed by earlier order_by sanitization, but that remediation left group_by and sub_group_by unvalidated. The issue does not directly disclose column values because issue_group_values() returns an empty list for unknown fields, the result projection uses a fixed required_fields list, and the subgrouped path raises KeyError before serialization. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:15:53.218416Z","id":"CVE-2026-104956","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/d3d3de44cf13991025783c598d8b34229fb47729","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9347","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-wwgj-929g-42cm","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-wwgj-929g-42cm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104960","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:11.307","lastModified":"2026-10-05T18:17:31.780","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs to the same workspace, is not a member of the victim's secret project, and knows the target asset UUID can receive a 302 redirect to a signed download URL. The intended project-scoped route for the same asset correctly returns 403. Confirmed affected project-bound asset types are ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER. This bypass exposes private file content protected by the secret project boundary. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T17:50:24.525391Z","id":"CVE-2026-104960","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/e63f0c3b3404d669ae05dd9050aab72292f87e5c","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9372","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-wrrw-wvfv-67h7","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-wrrw-wvfv-67h7","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104961","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:11.460","lastModified":"2026-10-06T18:16:43.320","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:33:59.934842Z","id":"CVE-2026-104961","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/6c9dbb50434d16ea00a00d1574723dfd0c3d2446","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9290","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-wjgv-cq7w-258v","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-104962","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:11.610","lastModified":"2026-10-05T19:17:15.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the endpoint, but its SAFE_METHODS branch checks only whether the caller is an active ProjectMember of any project in the workspace and does not bind the check to view.project_id. The view then filters solely by the project_id supplied in the URL. Consequently, any authenticated user who belongs to one project in a workspace, including a Guest, can read the roster of another private project in the same workspace. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:34:37.833506Z","id":"CVE-2026-104962","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/5842ca8bf2b984b81c45bf58148a39b348a8995e","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9375","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-w2vf-m9x9-mvmc","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-w2vf-m9x9-mvmc","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104963","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:11.770","lastModified":"2026-10-07T21:17:09.710","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs to each project. Any authenticated workspace member, including a Guest with access to only one project, can enumerate names, descriptions, sprint dates, issue counts, progress snapshots, external integration IDs, linked URLs, and member lists for cycles and modules in private projects. The sibling WorkspaceLabelsEndpoint and WorkspaceStatesEndpoint apply the correct project__project_projectmember__member=request.user filter, making the cycle and module endpoints inconsistent outliers. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:52:36.914862Z","id":"CVE-2026-104963","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/b3591b9e6354f39715203787cc21f0cccd2cb3a9","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9373","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-wcc5-qgfr-8g9c","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-wcc5-qgfr-8g9c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104964","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:11.943","lastModified":"2026-10-05T20:17:09.833","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a project in another workspace when the victim project UUID is known. This violates tenant isolation and permits unauthorized cross-workspace changes to project metadata and configuration. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:55:33.488838Z","id":"CVE-2026-104964","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/9491bdbe46e269611f9dad9cfb5182c2da8ca65a","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-pp22-3ghf-949q","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-pp22-3ghf-949q","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104965","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:12.103","lastModified":"2026-10-05T18:17:31.887","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace on the instance, leaking issue metadata through activity events. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T17:49:30.511086Z","id":"CVE-2026-104965","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/81d9873d7f1cf1d1252ed53c12dd33696be73a89","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9269","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-8cvv-8jh5-g6mj","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-8cvv-8jh5-g6mj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104966","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:12.283","lastModified":"2026-10-06T18:16:43.437","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/, and can inject comments into an issue from another workspace through POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/. ProjectEntityPermission verifies membership in the workspace and project from the URL, but estimate_id and issue_id are fetched by primary key without confirming the same scope. The list, retrieve, and destroy handlers correctly scope their queries, demonstrating the inconsistency. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:34:02.594473Z","id":"CVE-2026-104966","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/971c2aadb4e848d70676b4f58b94bc7992dfe5fc","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9286","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-933r-rxg8-f3h2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-104967","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:12.453","lastModified":"2026-10-05T19:17:15.430","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission decorator on each endpoint validates only that the caller is a member or administrator of the workspace and project named in the URL. BulkDeleteIssuesEndpoint can destroy CycleIssue and ModuleIssue associations belonging to foreign issues. SubIssuesEndpoint can re-parent foreign issues under an attacker-selected issue and return the foreign issues' metadata. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:36:37.209629Z","id":"CVE-2026-104967","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/ad73ca300ce35e4d4d231a933de6f20f8203f3df","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9270","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-6cw7-h92q-p9hg","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-104968","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:12.627","lastModified":"2026-10-05T20:17:09.970","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The endpoint also exposes ProjectMember rows under the same condition. SearchEndpoint in apps/api/plane/app/views/search/base.py inherits BaseAPIView with only permission_classes = [IsAuthenticated] and performs no workspace-membership check. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:05:28.852935Z","id":"CVE-2026-104968","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/28ae25b564351abaf8b36d4a3ba6d32f80fbf075","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9296","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-32q3-mqpc-3mhv","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-32q3-mqpc-3mhv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104969","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:12.783","lastModified":"2026-10-05T18:17:32.003","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is already assigned to a cycle, the operation removes it from the victim's cycle, causing a destructive cross-tenant write. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T17:47:06.863715Z","id":"CVE-2026-104969","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/81d9873d7f1cf1d1252ed53c12dd33696be73a89","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9269","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-22g9-9xfv-q3fr","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-22g9-9xfv-q3fr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104970","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T17:17:12.937","lastModified":"2026-10-06T15:17:13.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first() for the first-admin check and performs account creation without an atomic transaction, row lock, uniqueness guard, or advisory lock. Two concurrent unauthenticated requests with different email addresses can both observe that no instance administrator exists, create separate User and InstanceAdmin rows, and receive sessions with instance-admin authority. This allows an attacker to share unrestricted instance administration with the legitimate operator. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:36:08.456033Z","id":"CVE-2026-104970","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/7fbf14a6cb494bbf5866e2b293b28a6d8a7e52c3","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9332","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-p548-28jp-wr4p","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105382","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T17:17:14.147","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function update_subaccount of the file php/controller.php of the component Account Administration. This manipulation of the argument user_id causes improper authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"onetwothreeneth","product":"HospitalManagementSystem","cpes":["cpe:2.3:a:onetwothreeneth:hospitalmanagementsystem:*:*:*:*:*:*:*:*"],"modules":["Account Administration"],"versions":[{"version":"9ef91ed6007314b6473110ed699dff76d158f61d","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T17:52:48.502739Z","id":"CVE-2026-105382","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/onetwothreeneth/HospitalManagementSystem/","source":"cna@vuldb.com"},{"url":"https://github.com/onetwothreeneth/HospitalManagementSystem/issues/7","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105382","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977736","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413576","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413576/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105383","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T17:17:14.327","lastModified":"2026-10-06T18:16:43.840","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transaction_idS leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"onetwothreeneth","product":"HospitalManagementSystem","cpes":["cpe:2.3:a:onetwothreeneth:hospitalmanagementsystem:*:*:*:*:*:*:*:*"],"versions":[{"version":"9ef91ed6007314b6473110ed699dff76d158f61d","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:06:29.144242Z","id":"CVE-2026-105383","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/onetwothreeneth/HospitalManagementSystem/","source":"cna@vuldb.com"},{"url":"https://github.com/onetwothreeneth/HospitalManagementSystem/issues/8","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105383","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977737","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413577","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413577/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-12171","sourceIdentifier":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","published":"2026-10-05T17:17:14.510","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require(), so running auto-changelog over attacker-controlled repository content (for example, in a CI workflow that checks out an untrusted pull request head, or locally on a forked or third-party repository) executes attacker-chosen code with the privileges of the invoking user or CI job, including access to workflow secrets, without the repository dependencies ever being installed. The plugins option similarly loads attacker-controlled modules from the repository. Under the same conditions, appendGitLog/appendGitTag allow git argument injection (e.g. --output= to write arbitrary files), output allows writing attacker-influenced content to arbitrary paths, and template causes an outbound request to an attacker-chosen URL. Version 2.6.1 treats in-repository configuration as untrusted and refuses to run when it sets these options, unless the new --unsafe-config flag is passed."}],"affected":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","affectedData":[{"vendor":"cookpete","product":"auto-changelog","defaultStatus":"unaffected","collectionURL":"https://www.npmjs.com/","packageName":"auto-changelog","repo":"https://github.com/cookpete/auto-changelog","versions":[{"version":"0","lessThan":"2.6.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:03:58.537396Z","id":"CVE-2026-12171","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-88"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-829"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/cookpete/auto-changelog/commit/1d02a48a0a57c69a3cd268aca375d64d50877c1a","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"url":"https://github.com/cookpete/auto-changelog/security/advisories/GHSA-xpvr-2hvx-m8q4","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158"},{"url":"https://github.com/cookpete/auto-changelog/security/advisories/GHSA-xpvr-2hvx-m8q4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-78412","sourceIdentifier":"cve@rapid7.com","published":"2026-10-05T17:17:16.183","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Velociraptor","defaultStatus":"unaffected","packageName":"Velociraptor","platforms":["Linux"],"repo":"https://github.com/Velocidex/velociraptor/","versions":[{"version":"0","lessThan":"0.77.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:04:33.376171Z","id":"CVE-2026-78412","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-78412","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-86671","sourceIdentifier":"emo@eclipse.org","published":"2026-10-05T17:17:16.910","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host allow-list and returns the response body to the caller. Any authenticated Che user can read arbitrary local files via the file:// scheme (including the pod's Kubernetes service-account token at `file:///var/run/secrets/kubernetes.io/serviceaccount/token`), reach internal HTTP services and cloud instance metadata endpoints (169.254.169.254), and have their stored SCM personal access token attached as an `Authorization` header to a host of their choosing. The same credential-forwarding behavior also fires when a victim opens a workspace from a malicious devfile whose `parent.uri` points to an attacker-controlled server, enabling exfiltration of the victim's SCM PAT without direct API access. No fix is available."}],"affected":[{"source":"emo@eclipse.org","affectedData":[{"vendor":"Eclipse Foundation","product":"Eclipse Che","defaultStatus":"unaffected","versions":[{"version":"7.29.0","lessThan":"7.123.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"emo@eclipse.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:03:25.686494Z","id":"CVE-2026-86671","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"emo@eclipse.org","type":"Secondary","description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-522"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/278","source":"emo@eclipse.org"},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/620","source":"emo@eclipse.org"},{"url":"https://redhat.atlassian.net/browse/CRW-11956","source":"emo@eclipse.org"}]}},{"cve":{"id":"CVE-2025-15643","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T18:17:28.767","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4."},{"lang":"es","value":"Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') vulnerabilidad en Jose Fernandez Adsmonetizer adsensei-b30 permite XSS Reflejado. Este problema afecta a Adsmonetizer: desde n/a hasta 3.2.4."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Jose Fernandez","product":"Adsmonetizer","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"adsensei-b30","versions":[{"version":"0","lessThanOrEqual":"3.2.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:17:04.176624Z","id":"CVE-2025-15643","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/adsensei-b30/vulnerability/wordpress-adsmonetizer-plugin-3-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-101919","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T18:17:30.907","lastModified":"2026-10-07T21:17:07.153","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this vulnerability by supplying a configuration containing unauthorized executable plugins. When downstream controllers consume this configuration, an attacker can achieve arbitrary code execution within the control plane."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"multicluster-engine/hypershift-rhel9-operator","cpes":["cpe:/a:redhat:multicluster_engine"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:15:51.214448Z","id":"CVE-2026-101919","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-101919","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542541","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-102295","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T18:17:31.057","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper input sanitization to run client-side scripts in the application context. Successful exploitation could allow the attacker to compromise the user's session, access sensitive registry information, or perform unauthorized actions on their behalf."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Quay 3","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quay/quay-rhel9","cpes":["cpe:/a:redhat:quay:3"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:37:46.129521Z","id":"CVE-2026-102295","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-102295","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542699","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-102576","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T18:17:31.200","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of the victim's authenticated browser session. Successful exploitation requires the target Quay deployment to use direct database authentication and the victim to complete login through the malicious URL."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Quay 3","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quay/quay-rhel9","cpes":["cpe:/a:redhat:quay:3"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T17:45:11.328947Z","id":"CVE-2026-102576","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-102576","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543208","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104905","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-05T18:17:31.623","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"NeoRazorX","product":"facturascripts","defaultStatus":"unaffected","repo":"https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-p89j-gj6f-fh6g","packageURL":"pkg:github/NeoRazorX/facturascripts","versions":[{"version":"2025.7","lessThan":"2026.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:01:13.923238Z","id":"CVE-2026-104905","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/NeoRazorX/facturascripts/releases/tag/v2026.7","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-p89j-gj6f-fh6g","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/facturascripts-php-object-injection-via-widgetselect","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-p89j-gj6f-fh6g","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104971","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:32.113","lastModified":"2026-10-05T19:17:15.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:38:20.168300Z","id":"CVE-2026-104971","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/commit/ac11c3ef7939e31201fa92a17de106906025590f","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/8885","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9288","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-p57q-8hh8-7fc7","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-p57q-8hh8-7fc7","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104973","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:32.290","lastModified":"2026-10-07T21:17:09.833","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhook_task.py performs a separate DNS resolution when sending the request and does not validate the resolved IP address, allowing DNS rebinding to bypass the SSRF protection. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:54:23.222680Z","id":"CVE-2026-104973","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9163","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-whh3-5g95-4qhc","source":"security-advisories@github.com"},{"url":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104974","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:32.473","lastModified":"2026-10-05T20:17:10.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with existing credentials. Successful authentication silently changes is_active back to True, reactivating the account without notifying the administrator. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:07:46.716051Z","id":"CVE-2026-104974","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/1e8f3630c7697129b61eb57f2453f0bf09224920","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/commit/6c9dbb50434d16ea00a00d1574723dfd0c3d2446","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9290","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9304","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-rmmf-rj2q-3rrg","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-rmmf-rj2q-3rrg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104975","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:32.747","lastModified":"2026-10-05T19:17:15.657","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and project_id and workspace__slug scoping to the asset endpoints in that file. The Spaces app in plane/space/views/asset.py serves related public-board operations under /api/public/ but was not remediated. Its EntityAssetEndpoint and AssetRestoreEndpoint resolve a DeployBoard from a public anchor and then read or modify FileAsset rows scoped only to the board's workspace, without a membership check or project_id constraint. An attacker can therefore read, overwrite, or restore assets across projects and workspaces. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T17:59:48.150470Z","id":"CVE-2026-104975","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9288","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-jh4v-88j2-g65v","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-jh4v-88j2-g65v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104976","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:32.913","lastModified":"2026-10-06T15:17:13.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call validate_url(). In addition, avatar_url is taken from the Gitea user's profile, where users can configure external avatar URLs. After an administrator enables Gitea OAuth for a legitimate instance, a Gitea user can set an internal URL as the profile avatar and log in through Gitea, causing Plane to fetch the internal target without validation. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:19.095347Z","id":"CVE-2026-104976","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9163","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-hx79-5pj5-qh42","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-104977","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:33.080","lastModified":"2026-10-05T19:17:15.790","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected internal targets, including cloud metadata at 169.254.169.254, and read the response body returned as the link title or favicon. Complete hardening exists on main in PR 9163 but was not included in an earlier released tag. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:39:50.576750Z","id":"CVE-2026-104977","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9163","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-hhj8-7hv6-m74r","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-hhj8-7hv6-m74r","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104978","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:33.247","lastModified":"2026-10-07T21:17:09.960","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email address. When a pending invitation targets an email address that has not registered with Plane, an attacker can enumerate the invitation, register an account using the invited email without mailbox verification, and accept the invitation. The attacker-controlled account is then added to the target workspace and project. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:55:49.764555Z","id":"CVE-2026-104978","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/14a4c22f94eac1582439e41112213f976c6a6cf7","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9308","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-g36h-p63v-g9c7","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-g36h-p63v-g9c7","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-104979","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:33.420","lastModified":"2026-10-05T20:17:10.243","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated user, including a new user with no workspace memberships, can plant arbitrary HTML in a project that has a published DeployBoard with intake enabled. When a project member or viewer of a closed intake item clicks the planted link, the TipTap \\tjavascript: parser bypass and the target=\"_self\" click handler execute JavaScript in the viewer's session and exfiltrate a long-lived API token. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:11:49.930509Z","id":"CVE-2026-104979","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/0d58adb69d859fc94c43b9d68fadd77e810d5ed1","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9287","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-hh2r-3hwp-mvq3","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-hh2r-3hwp-mvq3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105384","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T18:17:35.553","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patient_info.php. Performing a manipulation of the argument patient_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"UNION","product":"HospitalManagementSystem","cpes":["cpe:2.3:a:union:hospitalmanagementsystem:*:*:*:*:*:*:*:*"],"versions":[{"version":"9ef91ed6007314b6473110ed699dff76d158f61d","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:39:12.381880Z","id":"CVE-2026-105384","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/onetwothreeneth/HospitalManagementSystem/issues/9","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105384","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/977738","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413578","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413578/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105385","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T18:17:35.740","lastModified":"2026-10-07T21:17:11.753","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an unknown functionality of the file transaction_details.php. Executing a manipulation of the argument transaction_id can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"onetwothreeneth","product":"HospitalManagementSystem","cpes":["cpe:2.3:a:onetwothreeneth:hospitalmanagementsystem:*:*:*:*:*:*:*:*"],"versions":[{"version":"9ef91ed6007314b6473110ed699dff76d158f61d","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:55:18.158601Z","id":"CVE-2026-105385","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/onetwothreeneth/HospitalManagementSystem/","source":"cna@vuldb.com"},{"url":"https://github.com/onetwothreeneth/HospitalManagementSystem/issues/10","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105385","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/980279","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413579","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413579/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105628","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:35.917","lastModified":"2026-10-05T18:17:36.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that redirects to an internal-only resource, such as a metadata endpoint, and Plane uploads the fetched response as a user avatar file. The object is then exposed through /api/assets/v2/static/{asset_id}/, allowing exfiltration of internally fetched content. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T17:56:44.537944Z","id":"CVE-2026-105628","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9163","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-cv9p-325g-wmv5","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-cv9p-325g-wmv5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105629","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:36.087","lastModified":"2026-10-06T15:17:13.580","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping. An administrator or member of one workspace can permanently delete an estimate point belonging to another workspace by supplying the target UUID in a URL under the attacker's own workspace. This creates a destructive cross-tenant IDOR. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:18.477038Z","id":"CVE-2026-105629","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/971c2aadb4e848d70676b4f58b94bc7992dfe5fc","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9286","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-7mr3-6cgx-3j95","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105630","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:36.250","lastModified":"2026-10-05T19:17:17.093","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:40:36.143539Z","id":"CVE-2026-105630","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-434"},{"lang":"en","value":"CWE-616"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/9dff20e04808286acb372119d88c666b802b1d50","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9312","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-ch8j-vr4r-qf6h","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-ch8j-vr4r-qf6h","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105631","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:36.427","lastModified":"2026-10-07T22:17:01.930","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private projects when the asset UUID is known. EntityAssetEndpoint.get is a separate public-anchor endpoint that grants AllowAny access and scopes the lookup only to the anchor's workspace rather than its published entity or project. An unauthenticated caller who knows a valid anchor and an asset UUID can therefore retrieve issue-description or comment-description assets belonging to unpublished or private projects in that workspace. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:57:11.995552Z","id":"CVE-2026-105631","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/commit/e63f0c3b3404d669ae05dd9050aab72292f87e5c","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9288","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9372","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-85h2-mhcc-xfmw","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-85h2-mhcc-xfmw","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105632","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:36.593","lastModified":"2026-10-05T20:17:11.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 (secret/private) projects they were never invited to and grants them a full Member role (read + write). The resolver checks only workspace-level membership/role and never checks the target project's visibility (network). This collapses project-level tenant isolation within a workspace: a low-privilege member can read and modify confidential data in every private project. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:13:14.016455Z","id":"CVE-2026-105632","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/e1ef42023ab66b5e722a8750e1bc5ba0d413a3ee","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9333","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-45hc-q4mw-jhxm","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-45hc-q4mw-jhxm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105633","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T18:17:36.757","lastModified":"2026-10-05T19:17:17.213","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user's attachment by its pk UUID. Because the server matches only pk, workspace, and project_id, it modifies the attachment regardless of the issue_id in the URL. When the attachment is pending and has not been confirmed as uploaded, the PATCH handler sets created_by = request.user and transfers attachment ownership to the attacker. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:21:45.443968Z","id":"CVE-2026-105633","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/5829f0febf0739494d576b60d4943d10d236bc96","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9315","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-5mxw-g5mw-3v3w","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-5mxw-g5mw-3v3w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-42700","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T18:17:36.940","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"GhozyLab","product":"Image Slider Widget","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"image-slider-widget","versions":[{"version":"0","lessThanOrEqual":"1.1.130","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T17:44:43.606968Z","id":"CVE-2026-42700","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/image-slider-widget/vulnerability/wordpress-image-slider-widget-plugin-1-1-130-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-78411","sourceIdentifier":"cve@rapid7.com","published":"2026-10-05T18:17:37.257","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata.\n\nServer metadata is often used to store site wide configuration data that should only be updated by the server admin."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Velociraptor","defaultStatus":"unaffected","packageName":"Velociraptor","platforms":["Linux"],"repo":"https://github.com/Velocidex/velociraptor/","versions":[{"version":"0","lessThan":"0.77.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:04:54.631828Z","id":"CVE-2026-78411","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-78411","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-78413","sourceIdentifier":"cve@rapid7.com","published":"2026-10-05T18:17:37.383","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch.\n\nThe `Windows.Sysinternals.SysmonLogForward` is a monitoring artifact used to forward sysmon events to the server. The artifact allows the user to specify an arbitrary binary path as a parameter, and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the \"Investigator\" role) to collect it from endpoints and run a different binary program than the installed sysmon binary.\nTo successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the \"Investigator\" role)."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Velociraptor","defaultStatus":"unaffected","packageName":"Velociraptor","platforms":["Linux"],"repo":"https://github.com/Velocidex/velociraptor/","versions":[{"version":"0","lessThan":"0.77.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:07:38.053928Z","id":"CVE-2026-78413","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-276"}]}],"references":[{"url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-78413","source":"cve@rapid7.com"},{"url":"https://github.com/Velocidex/velociraptor/commit/7906c82fad728010f2fe1d0555b99dbaba3ce88f","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-93316","sourceIdentifier":"security@docker.com","published":"2026-10-05T18:17:37.780","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident."}],"affected":[{"source":"security@docker.com","affectedData":[{"vendor":"moby","product":"BuildKit","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.33.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@docker.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:05:26.495778Z","id":"CVE-2026-93316","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@docker.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.33.1","source":"security@docker.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-r456-g3gm-cvxf","source":"security@docker.com"}]}},{"cve":{"id":"CVE-2026-93317","sourceIdentifier":"security@docker.com","published":"2026-10-05T18:17:37.923","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity."}],"affected":[{"source":"security@docker.com","affectedData":[{"vendor":"moby","product":"BuildKit","defaultStatus":"unaffected","packageName":"github.com/moby/buildkit","versions":[{"version":"0.28.0","lessThan":"0.33.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@docker.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:05:59.752463Z","id":"CVE-2026-93317","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@docker.com","type":"Secondary","description":[{"lang":"en","value":"CWE-354"}]}],"references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.33.1","source":"security@docker.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-p3rc-w3hc-pqvv","source":"security@docker.com"}]}},{"cve":{"id":"CVE-2026-93318","sourceIdentifier":"security@docker.com","published":"2026-10-05T18:17:38.080","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents.\n\nIf a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build.\n\nThe issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz."}],"affected":[{"source":"security@docker.com","affectedData":[{"vendor":"moby","product":"BuildKit","defaultStatus":"unaffected","packageName":"github.com/moby/buildkit","versions":[{"version":"0","lessThan":"0.33.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@docker.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:06:32.028591Z","id":"CVE-2026-93318","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@docker.com","type":"Secondary","description":[{"lang":"en","value":"CWE-354"}]}],"references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.33.1","source":"security@docker.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-f2v9-hprr-32q3","source":"security@docker.com"}]}},{"cve":{"id":"CVE-2026-93319","sourceIdentifier":"security@docker.com","published":"2026-10-05T18:17:38.217","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic."}],"affected":[{"source":"security@docker.com","affectedData":[{"vendor":"moby","product":"BuildKit","defaultStatus":"unaffected","packageName":"github.com/moby/buildkit","versions":[{"version":"0","lessThanOrEqual":"0.33.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@docker.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:07:02.797511Z","id":"CVE-2026-93319","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@docker.com","type":"Secondary","description":[{"lang":"en","value":"CWE-567"}]}],"references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.33.1","source":"security@docker.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-4hgw-qrhw-fhg8","source":"security@docker.com"}]}},{"cve":{"id":"CVE-2026-93320","sourceIdentifier":"security@docker.com","published":"2026-10-05T18:17:38.353","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access."}],"affected":[{"source":"security@docker.com","affectedData":[{"vendor":"moby","product":"BuildKit","defaultStatus":"unaffected","packageName":"github.com/moby/buildkit","versions":[{"version":"0","lessThanOrEqual":"0.33.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@docker.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:52:01.509494Z","id":"CVE-2026-93320","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@docker.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.33.1","source":"security@docker.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-9728-qjrv-2xh2","source":"security@docker.com"}]}},{"cve":{"id":"CVE-2026-93322","sourceIdentifier":"security@docker.com","published":"2026-10-05T18:17:39.490","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A malicious frontend can submit an LLB definition that causes buildkitd\nto panic and terminate, interrupting all builds running on that daemon."}],"affected":[{"source":"security@docker.com","affectedData":[{"vendor":"moby","product":"BuildKit","defaultStatus":"unaffected","packageName":"github.com/moby/buildkit","versions":[{"version":"0","lessThanOrEqual":"0.33.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@docker.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:48:11.979709Z","id":"CVE-2026-93322","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@docker.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.33.1","source":"security@docker.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-cv6p-7w7g-xjwq","source":"security@docker.com"}]}},{"cve":{"id":"CVE-2026-93323","sourceIdentifier":"security@docker.com","published":"2026-10-05T18:17:39.630","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which interrupts other builds on the same instance. Fixed by rejecting such files above 16 MiB."}],"affected":[{"source":"security@docker.com","affectedData":[{"vendor":"moby","product":"BuildKit","defaultStatus":"unaffected","packageName":"github.com/moby/buildkit","versions":[{"version":"0","lessThanOrEqual":"0.33.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@docker.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:47:20.730540Z","id":"CVE-2026-93323","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@docker.com","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.33.1","source":"security@docker.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-mgqf-486f-49vp","source":"security@docker.com"}]}},{"cve":{"id":"CVE-2026-100509","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:12.047","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Webful Creations","product":"RepairBuddy","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"computer-repair-shop","versions":[{"version":"0","lessThanOrEqual":"4.1225","versionType":"custom","status":"affected","changes":[{"at":"4.1227","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:49:16.503879Z","id":"CVE-2026-100509","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-4-1225-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-100515","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:12.200","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"VillaTheme","product":"Photo Reviews for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-photo-reviews","versions":[{"version":"0","lessThanOrEqual":"1.2.30","versionType":"custom","status":"affected","changes":[{"at":"1.2.31","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:16:55.730649Z","id":"CVE-2026-100515","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-photo-reviews/vulnerability/wordpress-photo-reviews-for-woocommerce-plugin-1-2-30-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-102383","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:12.457","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"VillaTheme","product":"Lookzy","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-lookbook","versions":[{"version":"0","lessThanOrEqual":"1.1.14","versionType":"custom","status":"affected","changes":[{"at":"1.1.15","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:41:59.884320Z","id":"CVE-2026-102383","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-lookbook/vulnerability/wordpress-lookzy-plugin-1-1-14-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103085","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:13.240","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP User Manager","product":"WP User Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-user-manager","versions":[{"version":"0","lessThanOrEqual":"2.9.20","versionType":"custom","status":"affected","changes":[{"at":"2.9.21","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:45:24.818860Z","id":"CVE-2026-103085","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-user-manager/vulnerability/wordpress-wp-user-manager-plugin-2-9-20-privilege-escalation-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103086","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:13.403","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Stiofan","product":"UsersWP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"userswp","versions":[{"version":"0","lessThanOrEqual":"1.2.74","versionType":"custom","status":"affected","changes":[{"at":"1.2.76","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:17:00.529309Z","id":"CVE-2026-103086","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/userswp/vulnerability/wordpress-userswp-plugin-1-2-74-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103334","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:13.543","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Etoile Web Design Incorporated","product":"Five Star Restaurant Reservations","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"restaurant-reservations","versions":[{"version":"0","lessThanOrEqual":"2.7.24","versionType":"custom","status":"affected","changes":[{"at":"2.8.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:47:16.769386Z","id":"CVE-2026-103334","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-201"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/restaurant-reservations/vulnerability/wordpress-five-star-restaurant-reservations-plugin-2-7-24-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103349","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:13.703","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Rymera Web Co","product":"Product Feed PRO for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-product-feed-pro","versions":[{"version":"0","lessThanOrEqual":"13.5.7","versionType":"custom","status":"affected","changes":[{"at":"13.5.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:16:30.437071Z","id":"CVE-2026-103349","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-product-feed-pro/vulnerability/wordpress-product-feed-pro-for-woocommerce-plugin-13-5-7-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103352","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:13.847","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP BASE","product":"WP BASE Booking","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-base-booking-of-appointments-services-and-events","versions":[{"version":"0","lessThanOrEqual":"6.4.0","versionType":"custom","status":"affected","changes":[{"at":"6.5.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:42:52.344028Z","id":"CVE-2026-103352","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-4-0-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104711","sourceIdentifier":"security@apache.org","published":"2026-10-05T19:17:14.497","lastModified":"2026-10-08T19:05:18.073","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Struts","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.struts:struts2-core","packageURL":"pkg:maven/org.apache.struts/struts2-core","versions":[{"version":"2.0.0","lessThanOrEqual":"2.3.37","versionType":"semver","status":"affected"},{"version":"2.5.0","lessThanOrEqual":"2.5.33","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThanOrEqual":"6.11.0","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThanOrEqual":"7.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:08:35.909211Z","id":"CVE-2026-104711","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-917"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndIncluding":"2.3.37","matchCriteriaId":"AB32EC52-8599-4E6C-9F87-D2BC050A2531"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"2.5.0","versionEndIncluding":"2.5.33","matchCriteriaId":"52DA80BB-35F0-4290-902F-66D27FB9A98F"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.12.0","matchCriteriaId":"B0839678-9096-43A2-BCE1-AA4A879C58E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.4.0","matchCriteriaId":"03A3E16E-2D82-49D3-B982-6BE2E3706C29"}]}]}],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-075","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/10","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-104712","sourceIdentifier":"security@apache.org","published":"2026-10-05T19:17:14.630","lastModified":"2026-10-08T19:11:24.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.\n\nThis issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Struts","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.struts:struts2-core","packageURL":"pkg:maven/org.apache.struts/struts2-core","versions":[{"version":"2.5.14","lessThanOrEqual":"2.5.33","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThanOrEqual":"6.11.0","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThanOrEqual":"7.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:09:49.658503Z","id":"CVE-2026-104712","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-405"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"2.5.14","versionEndIncluding":"2.5.33","matchCriteriaId":"BCFD0E7B-5A78-4F25-A209-D8757E0EBE8A"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.12.0","matchCriteriaId":"B0839678-9096-43A2-BCE1-AA4A879C58E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.4.0","matchCriteriaId":"03A3E16E-2D82-49D3-B982-6BE2E3706C29"}]}]}],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-076","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/11","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-104713","sourceIdentifier":"security@apache.org","published":"2026-10-05T19:17:14.757","lastModified":"2026-10-08T19:15:41.920","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.\n\nThis issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Struts","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.struts:struts2-rest-plugin","packageURL":"pkg:maven/org.apache.struts/struts2-rest-plugin","versions":[{"version":"2.1.8","lessThanOrEqual":"2.3.37","versionType":"semver","status":"affected"},{"version":"2.5.0","lessThanOrEqual":"2.5.33","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThanOrEqual":"6.11.0","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThanOrEqual":"7.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:11:48.988162Z","id":"CVE-2026-104713","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"2.1.8","versionEndIncluding":"2.3.37","matchCriteriaId":"4693302A-5635-4913-8EA5-CB4E34139205"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"2.5.0","versionEndIncluding":"2.5.33","matchCriteriaId":"52DA80BB-35F0-4290-902F-66D27FB9A98F"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.12.0","matchCriteriaId":"B0839678-9096-43A2-BCE1-AA4A879C58E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.4.0","matchCriteriaId":"03A3E16E-2D82-49D3-B982-6BE2E3706C29"}]}]}],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-077","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/12","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-104714","sourceIdentifier":"security@apache.org","published":"2026-10-05T19:17:14.883","lastModified":"2026-10-08T19:16:14.527","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Struts","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.struts:struts2-core","packageURL":"pkg:maven/org.apache.struts/struts2-core","versions":[{"version":"2.0.0","lessThanOrEqual":"2.3.37","versionType":"semver","status":"affected"},{"version":"2.5.0","lessThanOrEqual":"2.5.33","versionType":"semver","status":"affected"},{"version":"6.0.0","lessThanOrEqual":"6.11.0","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThanOrEqual":"7.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:13:22.832050Z","id":"CVE-2026-104714","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndIncluding":"2.3.37","matchCriteriaId":"AB32EC52-8599-4E6C-9F87-D2BC050A2531"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"2.5.0","versionEndIncluding":"2.5.33","matchCriteriaId":"52DA80BB-35F0-4290-902F-66D27FB9A98F"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.12.0","matchCriteriaId":"B0839678-9096-43A2-BCE1-AA4A879C58E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.4.0","matchCriteriaId":"03A3E16E-2D82-49D3-B982-6BE2E3706C29"}]}]}],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-078","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/13","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-105326","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T19:17:16.393","lastModified":"2026-10-07T18:17:15.577","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with \"-\" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"cups-main","cpes":["cpe:/a:redhat:hummingbird:1"],"versions":[{"version":"2.4.19-4.3.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cups","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cups","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cups","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhel9/cups","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":2.5,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:43:04.210560Z","id":"CVE-2026-105326","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:77638","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-105326","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545835","source":"secalert@redhat.com"},{"url":"https://github.com/OpenPrinting/cups/commit/1244ed9","source":"secalert@redhat.com"},{"url":"https://github.com/OpenPrinting/cups/commit/611d1bd","source":"secalert@redhat.com"},{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-105386","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T19:17:16.700","lastModified":"2026-10-06T17:17:17.633","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this issue is the function get of the file print.php. The manipulation of the argument transaction_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"onetwothreeneth","product":"HospitalManagementSystem","cpes":["cpe:2.3:a:onetwothreeneth:hospitalmanagementsystem:*:*:*:*:*:*:*:*"],"versions":[{"version":"9ef91ed6007314b6473110ed699dff76d158f61d","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:56:21.795032Z","id":"CVE-2026-105386","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/onetwothreeneth/HospitalManagementSystem/","source":"cna@vuldb.com"},{"url":"https://github.com/onetwothreeneth/HospitalManagementSystem/issues/11","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105386","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/984330","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413580","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413580/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105387","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T19:17:16.910","lastModified":"2026-10-06T18:16:43.983","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"girishsaraf","product":"Online-Appointment-Booking-System","cpes":["cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"],"modules":["Patient Login Handler"],"versions":[{"version":"f427b4757128ca253d33d0cc4e87bbb9c999a4d5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:06:30.591048Z","id":"CVE-2026-105387","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/","source":"cna@vuldb.com"},{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/5","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105387","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/980739","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413581","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413581/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105634","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:17.330","lastModified":"2026-10-06T15:17:13.693","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST role, to modify another project member's role. The authorization check prevents assigning a role higher than the requester's role but does not prevent assigning a lower or equal role, allowing a Guest to demote Administrators and Members and deny them project control. This vulnerability is fixed in 1.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:17.859962Z","id":"CVE-2026-105634","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/587fe76032fb69275866fdeb655699a70a83c521","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/8833","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-494h-3rcq-5g3c","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105635","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:17.503","lastModified":"2026-10-05T19:17:17.650","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches project_invite.email and does not validate the invitation token. An attacker who knows the invitation UUID can discover the invited email, register an account with that email, and accept the invitation without receiving the original invite. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:41:24.401855Z","id":"CVE-2026-105635","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/4b52dce76e8aa97a8d87166fa8f4441c1cf646b1","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9305","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-2r58-hgv7-635q","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-2r58-hgv7-635q","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105636","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:17.693","lastModified":"2026-10-07T22:17:02.053","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks private, loopback, link-local, and reserved addresses in the original webhook URL, but the final URL reached after one or more redirects is not checked. A user who can create a workspace can register a webhook pointing to an attacker-controlled public endpoint that returns a 302 redirect to an internal address. The Plane worker then fetches internal resources, including cloud metadata, and stores the response body in webhook_logs, where the attacker can retrieve it through the workspace webhook-logs API. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T21:39:13.833798Z","id":"CVE-2026-105636","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9163","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-mq87-52pf-hm3h","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-mq87-52pf-hm3h","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105637","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:17.860","lastModified":"2026-10-05T20:17:11.203","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the URL. A workspace Guest can provide asset UUIDs from another project in the same workspace and reassign their issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity the attacker controls. Plane then treats the attacker's project as the new owner and provides a presigned download URL for the hijacked file. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:09:42.896444Z","id":"CVE-2026-105637","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/15e835710c7f938e0fae9c0ee77bb8162ff436a0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9495","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-r2hw-fff3-pjwp","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-r2hw-fff3-pjwp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105638","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:18.030","lastModified":"2026-10-05T19:17:18.173","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware. This vulnerability is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:43:46.990678Z","id":"CVE-2026-105638","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-307"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/b1c78fe4c832e188454840eb38fd20cd05ef8b0a","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9130","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-mqjv-rwgv-4gxq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105639","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:18.213","lastModified":"2026-10-06T15:17:13.803","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which returns each WorkspaceMemberInvite whose email matches request.user.email. WorkSpaceMemberInviteSerializer uses fields = \"all\", exposing the token that protects the invitation join endpoint. An unauthenticated attacker who knows a target's email can register an account using that address, enumerate pending invitations, and accept an invitation as the target, joining a workspace at the invited role. The term pre-auth describes the attacker's initial state: the attacker has no credential before signup, while the enumeration and join requests use the session created by that signup. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:37:11.181590Z","id":"CVE-2026-105639","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/6220ba990b2276a1a1979d1d5df68f650b8b47ad","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9297","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-4vj8-p63v-8p24","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105640","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:18.383","lastModified":"2026-10-05T19:17:18.520","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:32:52.620033Z","id":"CVE-2026-105640","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/b91b61c379908d9e451613dbca23fc3803e926d2","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9289","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-7j95-vh8g-f365","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-7j95-vh8g-f365","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105641","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:18.560","lastModified":"2026-10-07T22:17:02.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain active when operators do not override them. The top-level setup.sh randomizes secrets only for the development Docker Compose path, leaving unchanged aio and cli community deployments with shared production secrets. Knowledge of SECRET_KEY enables attackers to forge Django-signed values and compromise accounts or sessions. Knowledge of LIVE_SERVER_SECRET_KEY bypasses live-service authentication on unchanged community deployments. This issue is fixed in 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"makeplane","product":"plane","versions":[{"version":"< 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T21:40:19.044873Z","id":"CVE-2026-105641","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://github.com/makeplane/plane/commit/1acc69e816a9a8789032bf711aa9a3c12fcd285c","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/pull/9291","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-cmwv-pjmw-8483","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105642","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:18.733","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. This issue is fixed in version 6.67.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 6.56.0, < 6.67.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:03:59.197785Z","id":"CVE-2026-105642","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-788w-68h3-cvxp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105643","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:18.900","lastModified":"2026-10-06T17:17:17.913","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, potentially compromising that user’s admin session. Self-hosted sites should leave the new  security.embedPreviewUrl  configuration option at its default value. This issue is fixed in version 6.67.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 6.34.0, < 6.67.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:55:12.677779Z","id":"CVE-2026-105643","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-653"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-69qc-f5m6-889c","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105644","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:19.060","lastModified":"2026-10-06T15:17:13.913","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. This issue is fixed in version 6.67.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 4.0.0, < 6.67.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:36:07.210854Z","id":"CVE-2026-105644","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/1be06f4e95a5eb159d14abda7660e689af13cff1","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/pull/31060","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.66.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-hqq2-xqr2-fmx2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105645","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:19.223","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 5.37.0, < 6.67.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:08:23.834511Z","id":"CVE-2026-105645","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/issues/31058","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.66.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-9m4w-fmjw-fvjq","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105646","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T19:17:19.373","lastModified":"2026-10-07T22:17:02.303","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 4.0.0, < 6.67.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T21:41:37.379990Z","id":"CVE-2026-105646","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/pull/31058","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.66.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-fwh9-qg68-vxp4","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105712","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T19:17:19.527","lastModified":"2026-10-06T16:00:36.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"GnuPG","product":"GnuPG","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.5.19","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","baseScore":3.6,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.0,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:09:21.224782Z","id":"CVE-2026-105712","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-61"}]}],"references":[{"url":"https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","source":"cve@mitre.org"},{"url":"https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","source":"cve@mitre.org"},{"url":"https://static.dev.gnupg.org/T8159.html","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-28625","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:19.817","lastModified":"2026-10-07T13:09:21.457","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T03:56:10.606566Z","id":"CVE-2026-28625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/aaos/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-28640","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:19.957","lastModified":"2026-10-07T13:08:48.297","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T03:56:08.435704Z","id":"CVE-2026-28640","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/aaos/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-28641","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:20.073","lastModified":"2026-10-07T13:08:22.517","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"16-qpr2","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T03:56:09.131309Z","id":"CVE-2026-28641","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/aaos/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-28647","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:20.187","lastModified":"2026-10-07T13:07:56.780","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"16-qpr2","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T03:56:06.333476Z","id":"CVE-2026-28647","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/aaos/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-28648","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:20.300","lastModified":"2026-10-07T13:06:17.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T03:56:07.028227Z","id":"CVE-2026-28648","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/aaos/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-28667","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:20.410","lastModified":"2026-10-07T13:05:28.530","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T20:55:25.090103Z","id":"CVE-2026-28667","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-45524","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:20.533","lastModified":"2026-10-07T13:05:04.523","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-45524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-49878","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:20.650","lastModified":"2026-10-07T13:04:48.300","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-49878","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-49880","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:20.763","lastModified":"2026-10-07T13:04:25.643","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T03:56:15.998592Z","id":"CVE-2026-49880","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-49885","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:20.873","lastModified":"2026-10-07T13:03:47.930","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-49885","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-49933","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:20.983","lastModified":"2026-10-07T13:14:09.670","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-49933","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-824"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-49937","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:21.103","lastModified":"2026-10-07T15:11:07.580","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-49937","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-55265","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:23.770","lastModified":"2026-10-07T15:09:16.567","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:38:50.297832Z","id":"CVE-2026-55265","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-55266","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:23.880","lastModified":"2026-10-07T15:09:40.857","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-55266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-55269","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:23.987","lastModified":"2026-10-07T15:10:08.650","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-55269","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*","matchCriteriaId":"9123E1DD-8607-427B-82B9-6E44B96C90F1"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-55270","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:24.097","lastModified":"2026-10-07T15:15:06.443","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-55270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*","matchCriteriaId":"FD695F32-4A73-4846-B1A1-04FF266E9C15"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*","matchCriteriaId":"3DE9F018-8704-476B-8D59-F63F8486E231"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*","matchCriteriaId":"BE95A642-4330-4F65-B028-3BA597D30F32"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-55280","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:24.207","lastModified":"2026-10-07T14:44:06.730","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-55280","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-457"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*","matchCriteriaId":"FD695F32-4A73-4846-B1A1-04FF266E9C15"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*","matchCriteriaId":"3DE9F018-8704-476B-8D59-F63F8486E231"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*","matchCriteriaId":"BE95A642-4330-4F65-B028-3BA597D30F32"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-55286","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:24.317","lastModified":"2026-10-07T14:22:13.460","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-55286","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-58815","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:24.423","lastModified":"2026-10-07T14:45:22.323","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-58815","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*","matchCriteriaId":"FD695F32-4A73-4846-B1A1-04FF266E9C15"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*","matchCriteriaId":"3DE9F018-8704-476B-8D59-F63F8486E231"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*","matchCriteriaId":"BE95A642-4330-4F65-B028-3BA597D30F32"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-58834","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:24.537","lastModified":"2026-10-07T15:15:22.350","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:10:37.537030Z","id":"CVE-2026-58834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*","matchCriteriaId":"FD695F32-4A73-4846-B1A1-04FF266E9C15"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*","matchCriteriaId":"3DE9F018-8704-476B-8D59-F63F8486E231"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*","matchCriteriaId":"BE95A642-4330-4F65-B028-3BA597D30F32"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-58835","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:24.650","lastModified":"2026-10-07T15:12:08.233","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-58835","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*","matchCriteriaId":"FD695F32-4A73-4846-B1A1-04FF266E9C15"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*","matchCriteriaId":"3DE9F018-8704-476B-8D59-F63F8486E231"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*","matchCriteriaId":"BE95A642-4330-4F65-B028-3BA597D30F32"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-58841","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:24.753","lastModified":"2026-10-07T15:13:02.650","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-58841","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*","matchCriteriaId":"FD695F32-4A73-4846-B1A1-04FF266E9C15"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*","matchCriteriaId":"3DE9F018-8704-476B-8D59-F63F8486E231"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*","matchCriteriaId":"BE95A642-4330-4F65-B028-3BA597D30F32"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-58854","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:24.857","lastModified":"2026-10-07T15:13:32.553","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-58854","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*","matchCriteriaId":"FD695F32-4A73-4846-B1A1-04FF266E9C15"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*","matchCriteriaId":"3DE9F018-8704-476B-8D59-F63F8486E231"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*","matchCriteriaId":"BE95A642-4330-4F65-B028-3BA597D30F32"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-58856","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:24.967","lastModified":"2026-10-07T15:13:51.890","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:09:51.422627Z","id":"CVE-2026-58856","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*","matchCriteriaId":"FD695F32-4A73-4846-B1A1-04FF266E9C15"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*","matchCriteriaId":"3DE9F018-8704-476B-8D59-F63F8486E231"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*","matchCriteriaId":"BE95A642-4330-4F65-B028-3BA597D30F32"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-58859","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:25.073","lastModified":"2026-10-07T15:14:02.667","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple places, there is a possible  denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-58859","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-248"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-58865","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:25.183","lastModified":"2026-10-07T15:14:22.670","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"},{"version":"15","status":"affected"},{"version":"14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:58:16.740162Z","id":"CVE-2026-58865","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","matchCriteriaId":"2700BCC5-634D-4EC6-AB67-5B678D5F951D"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","matchCriteriaId":"8538774C-906D-4B03-A3E7-FA7A55E0DA9E"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*","matchCriteriaId":"FD695F32-4A73-4846-B1A1-04FF266E9C15"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*","matchCriteriaId":"3DE9F018-8704-476B-8D59-F63F8486E231"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*","matchCriteriaId":"BE95A642-4330-4F65-B028-3BA597D30F32"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-58880","sourceIdentifier":"security@android.com","published":"2026-10-05T19:17:25.377","lastModified":"2026-10-07T15:14:45.407","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"affected":[{"source":"security@android.com","affectedData":[{"vendor":"Google","product":"Android","defaultStatus":"unaffected","versions":[{"version":"17","status":"affected"},{"version":"16-qpr2","status":"affected"},{"version":"16","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T00:00:00+00:00","id":"CVE-2026-58880","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*","matchCriteriaId":"02882AB1-7993-47DD-84A0-8DF4272D85ED"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*","matchCriteriaId":"FD695F32-4A73-4846-B1A1-04FF266E9C15"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*","matchCriteriaId":"3DE9F018-8704-476B-8D59-F63F8486E231"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*","matchCriteriaId":"BE95A642-4330-4F65-B028-3BA597D30F32"},{"vulnerable":true,"criteria":"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*","matchCriteriaId":"E3D15FD9-304E-4270-81C7-C8D9024D457D"}]}]}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","source":"security@android.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-88424","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T19:17:26.053","lastModified":"2026-10-06T17:17:27.667","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:00:45.844362Z","id":"CVE-2026-88424","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/xuex86438-netizen/FineAdmin.Mvc-Pagination-Sort-Parameter-SQL-Injection-Permissions-Button-List-/blob/main/FineAdmin.Mvc%20Pagination%20Sort-Parameter%20SQL%20Injection%20%28/Permissions/Button/List%29","source":"cve@mitre.org"},{"url":"https://github.com/xuex86438-netizen/FineAdmin.Mvc-Pagination-Sort-Parameter-SQL-Injection-Permissions-Button-List-/blob/main/FineAdmin.Mvc%20Pagination%20Sort-Parameter%20SQL%20Injection%20%28/Permissions/Button/List%29","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95165","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T19:17:26.517","lastModified":"2026-10-12T17:17:38.647","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:57:03.642573Z","id":"CVE-2026-95165","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/hekk-one/CVE","source":"cve@mitre.org"},{"url":"https://hekk.one/posts/research/cve-2026-95165/","source":"cve@mitre.org"},{"url":"https://hekk.one/posts/research/cve-2026-95165/","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95166","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T19:17:26.640","lastModified":"2026-10-12T17:17:38.817","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T22:14:25.221382Z","id":"CVE-2026-95166","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/hekk-one/CVE","source":"cve@mitre.org"},{"url":"https://hekk.one/posts/research/cve-2026-95166/","source":"cve@mitre.org"},{"url":"https://hekk.one/posts/research/cve-2026-95166/","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97070","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:26.750","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"CozyThemes","product":"Cozy Blocks","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"cozy-addons","versions":[{"version":"0","lessThanOrEqual":"2.2.23","versionType":"custom","status":"affected","changes":[{"at":"2.2.24","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:44:16.482130Z","id":"CVE-2026-97070","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/cozy-addons/vulnerability/wordpress-cozy-blocks-plugin-2-2-23-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97275","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:26.890","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"VillaTheme","product":"BuildKit – Product Builder for WooCommerce – Custom PC Builder","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-product-builder","versions":[{"version":"0","lessThanOrEqual":"1.0.28","versionType":"custom","status":"affected","changes":[{"at":"1.0.29","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:16:45.804733Z","id":"CVE-2026-97275","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1284"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-product-builder/vulnerability/wordpress-buildkit-product-builder-for-woocommerce-custom-pc-builder-plugin-1-0-28-bypass-vulnerability-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97283","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:27.133","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Liquid Web / StellarWP","product":"Advanced Post Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"advanced-post-manager","versions":[{"version":"0","lessThanOrEqual":"4.5.5","versionType":"custom","status":"affected","changes":[{"at":"4.5.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:46:30.456481Z","id":"CVE-2026-97283","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/advanced-post-manager/vulnerability/wordpress-advanced-post-manager-plugin-4-5-5-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97303","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:27.267","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Apps Mav","product":"Scratch & Win – Giveaways and Contests","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"scratch-win-giveaways-for-website-facebook","versions":[{"version":"0","lessThanOrEqual":"3.0.2","versionType":"custom","status":"affected","changes":[{"at":"3.1.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:16:34.603244Z","id":"CVE-2026-97303","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/scratch-win-giveaways-for-website-facebook/vulnerability/wordpress-scratch-win-giveaways-and-contests-plugin-3-0-2-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97304","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:27.390","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Arraytics","product":"Timetics","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"timetics","versions":[{"version":"0","lessThanOrEqual":"1.0.63","versionType":"custom","status":"affected","changes":[{"at":"1.0.64","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:42:24.364350Z","id":"CVE-2026-97304","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/timetics/vulnerability/wordpress-timetics-plugin-1-0-63-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97305","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:27.527","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Themeisle","product":"AI Chatbot for WordPress – Hyve Lite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"hyve-lite","versions":[{"version":"0","lessThanOrEqual":"2.0.2","versionType":"custom","status":"affected","changes":[{"at":"2.0.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T18:45:02.675112Z","id":"CVE-2026-97305","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/hyve-lite/vulnerability/wordpress-ai-chatbot-for-wordpress-hyve-lite-plugin-2-0-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-97309","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T19:17:27.667","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Webful Creations","product":"RepairBuddy","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"computer-repair-shop","versions":[{"version":"0","lessThanOrEqual":"4.1226","versionType":"custom","status":"affected","changes":[{"at":"4.1227","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:16:51.990085Z","id":"CVE-2026-97309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-4-1226-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-100506","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T20:17:03.760","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Spell Check","product":"WP Spell Check","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-spell-check","versions":[{"version":"0","lessThanOrEqual":"12.1","versionType":"custom","status":"affected","changes":[{"at":"12.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:22:17.926463Z","id":"CVE-2026-100506","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-spell-check/vulnerability/wordpress-wp-spell-check-plugin-12-1-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-100511","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T20:17:07.177","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Vektor Inc.","product":"VK Google Job Posting Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"vk-google-job-posting-manager","versions":[{"version":"0","lessThanOrEqual":"1.3.1","versionType":"custom","status":"affected","changes":[{"at":"1.3.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:22:24.458725Z","id":"CVE-2026-100511","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/vk-google-job-posting-manager/vulnerability/wordpress-vk-google-job-posting-manager-plugin-1-3-1-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103066","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T20:17:08.027","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP BASE","product":"WP BASE Booking","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-base-booking-of-appointments-services-and-events","versions":[{"version":"0","lessThanOrEqual":"6.4.0","versionType":"custom","status":"affected","changes":[{"at":"6.5.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:22:10.897169Z","id":"CVE-2026-103066","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-4-0-sql-injection-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103337","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T20:17:08.177","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Kirillbdev","product":"WC Ukraine Shipping","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wc-ukr-shipping","versions":[{"version":"0","lessThanOrEqual":"1.23.2","versionType":"custom","status":"affected","changes":[{"at":"1.23.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:16:25.224044Z","id":"CVE-2026-103337","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wc-ukr-shipping/vulnerability/wordpress-wc-ukraine-shipping-plugin-1-23-2-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-103348","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T20:17:08.330","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Smackcoders Inc.","product":"WP Ultimate Exporter","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-ultimate-exporter","versions":[{"version":"0","lessThanOrEqual":"3.0","versionType":"custom","status":"affected","changes":[{"at":"3.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:25:27.227059Z","id":"CVE-2026-103348","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-ultimate-exporter/vulnerability/wordpress-wp-ultimate-exporter-plugin-3-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-104029","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T20:17:08.487","lastModified":"2026-10-07T22:17:01.570","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs responder process to crash, resulting in a denial of service (DoS)."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T21:43:35.551652Z","id":"CVE-2026-104029","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104029","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479444","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-104030","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T20:17:08.637","lastModified":"2026-10-06T15:09:20.387","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sssd","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:37:19.135952Z","id":"CVE-2026-104030","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104030","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479429","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-105388","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T20:17:10.393","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument group_id causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"feelec-yishu","product":"feelcrm-os","cpes":["cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*"],"modules":["Member Endpoint"],"versions":[{"version":"1.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:39:11.522989Z","id":"CVE-2026-105388","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/feelec-yishu/feelcrm-os/","source":"cna@vuldb.com"},{"url":"https://github.com/feelec-yishu/feelcrm-os/issues/6","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105388","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/979535","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413582","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413582/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105389","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T20:17:10.610","lastModified":"2026-10-07T22:17:01.760","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"feelec-yishu","product":"feelcrm-os","cpes":["cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*"],"modules":["UploadTicketFile Endpoint"],"versions":[{"version":"1.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T21:45:27.862587Z","id":"CVE-2026-105389","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/feelec-yishu/feelcrm-os/","source":"cna@vuldb.com"},{"url":"https://github.com/feelec-yishu/feelcrm-os/issues/7","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105389","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/979554","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413583","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413583/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105392","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T20:17:10.827","lastModified":"2026-10-06T18:16:45.200","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key\r . Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project maintainer explains: \"The issue with this key is described in the documentation. Developers need to manually change their keys before deployment.\""}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Lybbn","product":"Django-Vue-Lyadmin","cpes":["cpe:2.3:a:lybbn:django-vue-lyadmin:*:*:*:*:*:*:*:*"],"modules":["JWT Signing"],"versions":[{"version":"3.2.0","status":"affected"},{"version":"3.2.1","status":"affected"},{"version":"3.2.2","status":"affected"},{"version":"3.2.3","status":"affected"},{"version":"3.2.4","status":"affected"},{"version":"3.2.5","status":"affected"},{"version":"3.2.6","status":"affected"},{"version":"3.2.7","status":"affected"},{"version":"3.2.8","status":"affected"},{"version":"3.2.9","status":"affected"},{"version":"3.2.10","status":"affected"},{"version":"3.2.11","status":"affected"},{"version":"3.2.12","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:20:40.726914Z","id":"CVE-2026-105392","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-320"},{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://github.com/lybbn/django-vue-lyadmin/","source":"cna@vuldb.com"},{"url":"https://github.com/lybbn/django-vue-lyadmin/issues/3","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105392","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/982747","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413586","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413586/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105647","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:13.157","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 6.54.1, < 6.65.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":4.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:52:08.241024Z","id":"CVE-2026-105647","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/3f8594eb53de883ac017545c358f59039cb152de","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/pull/30918","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.65.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-322m-ff4g-9vx9","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105648","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:13.420","lastModified":"2026-10-06T17:17:18.023","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A successful attack would not result in any response data being returned. This issue is fixed in version 6.65.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 6.0.9, < 6.65.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":4.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:53:54.002822Z","id":"CVE-2026-105648","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/20d3f792bf4a7c349ee56b746a067550d8684ff5","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/pull/30917","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.65.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-r7f2-6fj8-6fg2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105649","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:13.613","lastModified":"2026-10-06T15:17:14.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 4.22.0, < 6.65.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:36:05.690270Z","id":"CVE-2026-105649","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/80686226d23df56749f6b7ebb484850a8eba8072","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/issues/30919","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.65.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-8575-cr6v-7jh4","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105650","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:13.817","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. This issue is fixed in version 6.64.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 2.5.0, < 6.64.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:38:21.403014Z","id":"CVE-2026-105650","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/d23d552e257e2696c60293bc5cd7898a49d6bd1f","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/pull/30763","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-v3xr-g6p2-fvgv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105651","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:14.010","lastModified":"2026-10-07T22:17:02.423","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 5.94.0, < 6.64.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T21:43:03.379087Z","id":"CVE-2026-105651","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/b41fe3f2c399cef058e6b487782a0b2263e86c03","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/issues/30761","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-347q-26qq-h2p6","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105652","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:14.180","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This issue is fixed in version 6.64.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 0.7.2, < 6.64.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:54:18.390457Z","id":"CVE-2026-105652","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-203"},{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/4fb587e4d49667f929b87f7d6a873ae5e9cc087f","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/pull/30760","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-53vv-xm9f-mm82","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105675","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:14.367","lastModified":"2026-10-06T17:17:18.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. This issue is fixed in version 6.64.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 4.39.0, < 6.64.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:52:23.960993Z","id":"CVE-2026-105675","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-203"},{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/4fb587e4d49667f929b87f7d6a873ae5e9cc087f","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/pull/30760","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-v6q3-xqxm-6f5v","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105676","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:14.547","lastModified":"2026-10-06T15:17:14.143","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is fixed in version 6.64.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 1.20.0, < 6.64.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:17.069483Z","id":"CVE-2026-105676","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/d2f498694be549074dd5817fd0e8a1371b65df02","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/issues/30635","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-m382-6jw4-fmp6","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105677","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:14.733","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 6.10.3, < 6.64.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:39:53.030196Z","id":"CVE-2026-105677","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/d2f498694be549074dd5817fd0e8a1371b65df02","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/issues/30635","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-jj74-hc2q-xrvm","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105678","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:14.913","lastModified":"2026-10-07T22:17:02.547","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 0.5.0, < 6.64.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T21:44:22.619499Z","id":"CVE-2026-105678","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/99c5642b9bb481df4811a004a6f19d6143ed9aaf","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/issues/30764","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-4pvx-fwjj-8gpc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105679","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:15.107","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file extension. This could be used to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 6.22.1, < 6.64.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:51:15.509890Z","id":"CVE-2026-105679","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/58669d5c8b898f8b69c1287c2779b29ecc7eb918","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/pull/30762","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.64.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-gfjp-2p8f-94qv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105680","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:15.903","lastModified":"2026-10-06T17:17:18.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 5.81.0, < 6.60.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:50:23.671868Z","id":"CVE-2026-105680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/cf2f718a67faa342c27989b701554ddd63862165","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/issues/30283","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.60.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-x3mg-q38v-m562","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105681","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:16.320","lastModified":"2026-10-06T15:17:14.253","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 5.9.0, < 6.44.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:16.346874Z","id":"CVE-2026-105681","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/405c2623ff9060295d4a87d3a0eb4ef766c8d2d3","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/pull/28297","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.44.1","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-6q6j-f24j-p477","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105682","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:16.647","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 1.18.0, < 6.27.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:42:03.534680Z","id":"CVE-2026-105682","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/815962dd2760e55c5dc8d0fb7fac732a7634566f","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/issues/27219","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.27.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-354h-gmhv-mr9c","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105683","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:17.123","lastModified":"2026-10-08T03:16:34.250","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"TryGhost","product":"Ghost","versions":[{"version":">= 6.14.0, < 6.27.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","baseScore":3.8,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:21:51.197736Z","id":"CVE-2026-105683","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-35"}]}],"references":[{"url":"https://github.com/TryGhost/Ghost/commit/770d438fd9d352bbfccbe81dd890580a1d3fd6f0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/pull/27217","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/releases/tag/v6.27.0","source":"security-advisories@github.com"},{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-83rp-q473-j88c","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105684","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:17.343","lastModified":"2026-10-05T21:16:34.777","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threads and full comment bodies from other pages in the same file, including commenter names, email addresses, photos, and page identifiers. The disclosed page identifiers can also be used with affected page-reading functionality to access unshared design content. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T20:32:21.226027Z","id":"CVE-2026-105684","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/6d9f411fab28a8f60cf807728f4fac2ecb646ca6","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-fwm4-hm9f-rmcp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105686","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:17.800","lastModified":"2026-10-06T17:17:18.360","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing each successful request to allocate another temporary object and increasing stored bytes beyond the upload session's declared logical size. Assembly detects the inconsistent chunk count only after allocation. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:48:43.615963Z","id":"CVE-2026-105686","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/06239844b10b123b7757969ab7618b201d3aba3b","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105687","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:17.997","lastModified":"2026-10-06T15:17:14.370","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock the owner out of the team and its projects, files, fonts, and media. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:15.607827Z","id":"CVE-2026-105687","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/45f0153e8fb1d9b70f2cb121b15780ba2c2085c4","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-j83r-hph3-xpxc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105688","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:18.193","lastModified":"2026-10-06T14:17:38.453","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by update-team-member-role. An administrator can invite another account as an owner, create multiple owners, and then use the new owner account to obtain owner-only control over the team. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:44:53.635776Z","id":"CVE-2026-105688","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/5efd9cc3c5689485322f57b644b83a3bd2e33cee","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-mx4v-cmxq-644v","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-mx4v-cmxq-644v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105689","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:18.397","lastModified":"2026-10-08T03:16:34.377","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT64 gateway or an attacker-controlled DNS AAAA record; cloud environments with NAT64 gateways are directly exploitable. A user controlling a media import URL, or an administrator controlling a webhook URL, can then supply an IPv6 transition address that embeds a cloud-metadata, loopback, link-local, or private IPv4 target and bypasses the intended SSRF restrictions. Media import can disclose response bodies, while webhook delivery can expose response status as a network-probing side channel. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:23:29.430898Z","id":"CVE-2026-105689","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/326d83e780ae120b45ccd6f3d7bd24922b54461c","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-wxgm-8qjw-x445","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-wxgm-8qjw-x445","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105690","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:18.943","lastModified":"2026-10-05T21:16:34.880","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated requests with the victim's authority until natural expiration. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T20:41:59.355159Z","id":"CVE-2026-105690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/7c85837290c4e7d6f7d99472b092ad4f7c9d6a97","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-mj9f-5cwq-7p3q","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105691","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:19.137","lastModified":"2026-10-06T17:17:18.470","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user who can edit a file can store shell metacharacters in the fill color and trigger SVG export, causing commands to execute with the exporter service's privileges. The same export can be triggered through a valid public share link to a malicious file. This vulnerability is fixed in 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:46:58.381592Z","id":"CVE-2026-105691","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/aa3bc1ae984577f0354d4270d2546e15985f4bcf","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/pull/11272","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105692","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:19.420","lastModified":"2026-10-06T15:17:14.480","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link or has owner or administrator authority, allowing any file editor who knows a share-link UUID to delete links created by other users and revoke external reviewers' access. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:14.813690Z","id":"CVE-2026-105692","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/209aea83658f209c4189b531eeda0f3a638a0294","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/pull/11290","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-8257-pm4f-cfhq","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105693","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:19.627","lastModified":"2026-10-06T14:17:38.580","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, page scopes, comment permissions, and inspection permissions, then replay a more permissive token to access page data that was not included in the original share. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:46:18.463606Z","id":"CVE-2026-105693","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/15195b3bbbbf2911b24007ad42453d264a2774d4","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-w8mf-4x22-24gg","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-w8mf-4x22-24gg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105694","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:19.813","lastModified":"2026-10-08T03:16:34.507","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A victim who navigates to the asset URL executes attacker-controlled JavaScript in that origin, allowing requests and data access with the victim's Penpot session authority. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:24:21.779529Z","id":"CVE-2026-105694","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/c4dd04353fcf06c3e10a64e3d8e43945508ae98c","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/pull/10989","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/pull/11044","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-wrcr-m7p8-m2c4","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-xg6f-5v5x-g4w2","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-xg6f-5v5x-g4w2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105695","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:20.017","lastModified":"2026-10-05T21:16:34.983","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed upload-session UUID can assemble the victim's chunks into the attacker's own file, team font, or project import, disclosing the uploaded bytes and deleting the victim's pending session. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T20:40:35.188252Z","id":"CVE-2026-105695","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/367e4d534c536c33d4f3fbad375f3e9c29b787a6","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/pull/11012","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-5vrm-3c6w-gjfv","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-5vrm-3c6w-gjfv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105696","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T20:17:20.240","lastModified":"2026-10-06T17:17:18.580","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and the attacker's own authenticated Penpot session can retrieve the complete shape and design data of another page in the same file when its identifier is known, because get-page requires authentication. The related get-file-fragment RPC also permits share-link access without mapping fragments to authorized pages. This issue is fixed in version 2.18.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"penpot","product":"penpot","versions":[{"version":"< 2.18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:44:35.306835Z","id":"CVE-2026-105696","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/penpot/penpot/commit/52573be07472987703b2ce715c4c10919f4e153e","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/releases/tag/2.18.0","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-x9xg-qphx-8grr","source":"security-advisories@github.com"},{"url":"https://github.com/penpot/penpot/security/advisories/GHSA-x9xg-qphx-8grr","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105766","sourceIdentifier":"82cea9a6-e9e3-46fe-bdb0-3673de380178","published":"2026-10-05T20:17:20.620","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"82cea9a6-e9e3-46fe-bdb0-3673de380178","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentation content served to a victim via an HTTPS request for a slashless directory path, because TLS terminates at the load balancer in front of Nginx and the resulting 301 response redirects the client to a plaintext http:// URL. Browsers that ship the HSTS preload list are not affected, because the .dev top-level domain is preloaded; clients that do not enforce HSTS, such as command-line HTTP clients and scripts that follow redirects, are affected."}],"affected":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","affectedData":[{"vendor":"Chainguard","product":"Chainguard Academy (edu)","defaultStatus":"unaffected","modules":["Nginx trailing-slash directory redirect"],"programFiles":["nginx.conf"],"repo":"https://github.com/chainguard-dev/edu","versions":[{"version":"0b75ff98057f69b044a3e7194e428066ac5ad0d4","lessThan":"93dc0e50739c225f5aee2e803800a47fc0feb906","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:43:50.196822Z","id":"CVE-2026-105766","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary","description":[{"lang":"en","value":"CWE-319"}]}],"references":[{"url":"https://github.com/chainguard-dev/edu/commit/93dc0e50739c225f5aee2e803800a47fc0feb906","source":"82cea9a6-e9e3-46fe-bdb0-3673de380178"},{"url":"https://github.com/chainguard-dev/edu/pull/3989","source":"82cea9a6-e9e3-46fe-bdb0-3673de380178"}]}},{"cve":{"id":"CVE-2026-105767","sourceIdentifier":"82cea9a6-e9e3-46fe-bdb0-3673de380178","published":"2026-10-05T20:17:20.840","lastModified":"2026-10-06T15:17:15.487","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the project_id or storage_bucket inputs to execute arbitrary shell commands on the GitHub Actions runner, because the inputs are interpolated directly into Bash gcloud storage cp commands in several steps via ${{ inputs.* }} expressions. The only in-repository caller passed repository secrets and ran only on trusted triggers, so no untrusted input was known to reach the vulnerable steps."}],"affected":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","affectedData":[{"vendor":"Chainguard","product":"Chainguard Academy (edu)","defaultStatus":"unaffected","modules":["integrate-platform-docs composite action"],"platforms":["GitHub Actions"],"programFiles":[".github/actions/integrate-platform-docs/action.yaml",".github/workflows/integrate-platform-docs/action.yaml",".github/workflows/integrate-enforce-docs/action.yaml"],"repo":"https://github.com/chainguard-dev/edu","versions":[{"version":"7375a80caabcc31c33ec90f29687ed78c13d16ff","lessThan":"fb0efb2537d326ab18c07d620875b8ed2a4b39f3","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:14:17.632816Z","id":"CVE-2026-105767","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/chainguard-dev/edu/commit/fb0efb2537d326ab18c07d620875b8ed2a4b39f3","source":"82cea9a6-e9e3-46fe-bdb0-3673de380178"},{"url":"https://github.com/chainguard-dev/edu/pull/3471","source":"82cea9a6-e9e3-46fe-bdb0-3673de380178"}]}},{"cve":{"id":"CVE-2026-71297","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T20:17:25.103","lastModified":"2026-10-06T15:17:19.260","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"multicluster-engine/cloudevents-conductor-rhel9","cpes":["cpe:/a:redhat:multicluster_engine"]},{"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"multicluster-engine/maestro-rhel9","cpes":["cpe:/a:redhat:multicluster_engine"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:42:56.062546Z","id":"CVE-2026-71297","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-71297","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511518","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-71298","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T20:17:25.267","lastModified":"2026-10-06T17:17:26.690","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"multicluster-engine/cloudevents-conductor-rhel9","cpes":["cpe:/a:redhat:multicluster_engine"]},{"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"multicluster-engine/maestro-rhel9","cpes":["cpe:/a:redhat:multicluster_engine"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:53:12.678480Z","id":"CVE-2026-71298","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-71298","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511519","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-71299","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T20:17:25.430","lastModified":"2026-10-07T21:17:16.700","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS)."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"multicluster-engine/cloudevents-conductor-rhel9","cpes":["cpe:/a:redhat:multicluster_engine"]},{"vendor":"Red Hat","product":"Multicluster Engine for Kubernetes","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"multicluster-engine/maestro-rhel9","cpes":["cpe:/a:redhat:multicluster_engine"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T20:13:29.558399Z","id":"CVE-2026-71299","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-71299","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511520","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-78860","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T20:17:27.283","lastModified":"2026-10-06T15:17:19.500","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:47:29.866611Z","id":"CVE-2026-78860","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-311"},{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"http://mercusys.com","source":"cve@mitre.org"},{"url":"https://threadpoolx.gitbook.io/docs/cve/mercusys-ac12-v2-security-advisory/missing-firmware-encryption-and-secure-boot-mechanisms","source":"cve@mitre.org"},{"url":"https://threadpoolx.gitbook.io/docs/cve/mercusys-ac12-v2-security-advisory/missing-firmware-encryption-and-secure-boot-mechanisms","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-78861","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T20:17:27.427","lastModified":"2026-10-06T17:17:26.800","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:12:39.142341Z","id":"CVE-2026-78861","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"http://ac12.com","source":"cve@mitre.org"},{"url":"http://mercusys.com","source":"cve@mitre.org"},{"url":"https://threadpoolx.gitbook.io/docs/cve/mercusys-ac12-v2-security-advisory/hardcoded-private-key","source":"cve@mitre.org"},{"url":"https://threadpoolx.gitbook.io/docs/cve/mercusys-ac12-v2-security-advisory/hardcoded-private-key","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-78862","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T20:17:27.570","lastModified":"2026-10-06T18:16:56.517","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (PCB)"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:54:36.278117Z","id":"CVE-2026-78862","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-1299"}]}],"references":[{"url":"http://ac12.com","source":"cve@mitre.org"},{"url":"http://mercusys.com","source":"cve@mitre.org"},{"url":"https://threadpoolx.gitbook.io/docs/cve/mercusys-ac12-v2-security-advisory/unprotected-physical-debug-interface-uart","source":"cve@mitre.org"},{"url":"https://threadpoolx.gitbook.io/docs/cve/mercusys-ac12-v2-security-advisory/unprotected-physical-debug-interface-uart","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-93617","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T20:17:28.537","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP Sunshine","product":"Sunshine Photo Cart","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"sunshine-photo-cart","versions":[{"version":"0","lessThanOrEqual":"3.7.1","versionType":"custom","status":"affected","changes":[{"at":"3.7.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:25:21.473573Z","id":"CVE-2026-93617","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-7-1-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94201","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-10-05T20:17:28.693","lastModified":"2026-10-06T15:03:59.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default (cast_input/2), which calls String.to_atom/1 when the attribute is configured with the unsafe_to_atom?: true constraint.\n\nFiltering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable :atom attribute declared with unsafe_to_atom?: true can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable version_action_name atom attribute with unsafe_to_atom?: true by default.\n\nThe fix adds a coerce/2 to Ash.Type.Atom that never interns atoms — a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (cast_input/2, which still honors unsafe_to_atom?) is unchanged.\n\nThis issue affects ash: from 3.5.1 before 3.34.3."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"ash-project","product":"ash","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"ash","cpes":["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Ash.Type.Atom'"],"programFiles":["lib/ash/type/atom.ex"],"programRoutines":[{"name":"'Elixir.Ash.Type.Atom':cast_value/2"}],"repo":"https://github.com/ash-project/ash","packageURL":"pkg:hex/ash","versions":[{"version":"3.5.1","lessThan":"3.34.3","versionType":"semver","status":"affected"}]},{"vendor":"ash-project","product":"ash","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"ash-project/ash","cpes":["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Ash.Type.Atom'"],"programFiles":["lib/ash/type/atom.ex"],"programRoutines":[{"name":"'Elixir.Ash.Type.Atom':cast_value/2"}],"repo":"https://github.com/ash-project/ash","packageURL":"pkg:github/ash-project/ash","versions":[{"version":"2970ba3bd5d36d6ad04c731ac87385375d457147","lessThan":"5282f3f513053628cdd1bf2236ea22d975d934d4","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:41:07.117450Z","id":"CVE-2026-94201","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-94201.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ash-project/ash/commit/2970ba3bd5d36d6ad04c731ac87385375d457147","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ash-project/ash/commit/5282f3f513053628cdd1bf2236ea22d975d934d4","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-94201","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}]}},{"cve":{"id":"CVE-2026-95263","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T20:17:29.050","lastModified":"2026-10-06T15:25:00.650","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not require the old password."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:04:20.376420Z","id":"CVE-2026-95263","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/liufee/cms","source":"cve@mitre.org"},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95263.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-95264","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T20:17:29.187","lastModified":"2026-10-06T23:16:56.873","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to `unlink()` without path traversal or directory validation."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T22:16:35.343749Z","id":"CVE-2026-95264","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/liufee/cms","source":"cve@mitre.org"},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95264.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-95265","sourceIdentifier":"cve@mitre.org","published":"2026-10-05T20:17:29.313","lastModified":"2026-10-06T15:17:20.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:07:14.146397Z","id":"CVE-2026-95265","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/liufee/cms","source":"cve@mitre.org"},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95265.md","source":"cve@mitre.org"},{"url":"https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95265.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97257","sourceIdentifier":"audit@patchstack.com","published":"2026-10-05T20:17:29.447","lastModified":"2026-10-06T15:04:25.990","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"PressTigers","product":"Simple Event Planner","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"simple-event-planner","versions":[{"version":"0","lessThanOrEqual":"1.5.7","versionType":"custom","status":"affected","changes":[{"at":"1.5.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T10:22:30.800009Z","id":"CVE-2026-97257","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/simple-event-planner/vulnerability/wordpress-simple-event-planner-plugin-1-5-7-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-101893","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-10-05T21:16:32.227","lastModified":"2026-10-11T17:16:56.950","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Newell Brands","product":"DYMO ID","defaultStatus":"unknown","versions":[{"version":"1.5.1.71","lessThan":"1.6.0","versionType":"custom","status":"affected"},{"version":"1.6.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":2.5}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"timestamp":"2026-10-02T15:34:09.447244Z","id":"CVE-2026-101893","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T16:53:41.283786Z","id":"CVE-2026-101893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"references":[{"url":"https://mediaserver.newellrubbermaid.com/industrial/Help/win/en/Content/What's%20New.htm","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-275-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101893","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://www.dymo.com/support?cfid=user-guide","source":"9119a7d8-5eab-497f-8521-727c672e3725"}]}},{"cve":{"id":"CVE-2026-102262","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-10-05T21:16:32.400","lastModified":"2026-10-11T17:16:57.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code execution at the victim's privilege level. Fixed in 1.6.0."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Newell Brands","product":"DYMO ID","defaultStatus":"unknown","versions":[{"version":"1.5.1.71","lessThan":"1.6.0","versionType":"custom","status":"affected"},{"version":"1.6.0","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":5.9}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"timestamp":"2026-10-01T14:37:33.409199Z","id":"CVE-2026-102262","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-11T16:53:33.691895Z","id":"CVE-2026-102262","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-668"}]}],"references":[{"url":"https://mediaserver.newellrubbermaid.com/industrial/Help/win/en/Content/What's%20New.htm","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-275-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102262","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://www.dymo.com/support?cfid=user-guide","source":"9119a7d8-5eab-497f-8521-727c672e3725"}]}},{"cve":{"id":"CVE-2026-105438","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T21:16:34.297","lastModified":"2026-10-06T18:16:45.357","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"O2OA","cpes":["cpe:2.3:a:o2oa:o2oa:*:*:*:*:*:*:*:*"],"modules":["General Module"],"versions":[{"version":"10.0.1-ce","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:05:50.612060Z","id":"CVE-2026-105438","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/o2oa/o2oa/","source":"cna@vuldb.com"},{"url":"https://github.com/o2oa/o2oa/issues/210","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105438","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/983598","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413603","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413603/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105444","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T21:16:34.470","lastModified":"2026-10-06T15:04:52.637","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"dotnet","product":"eShop","cpes":["cpe:2.3:a:dotnet:eshop:*:*:*:*:*:*:*:*"],"modules":["Ordering API"],"versions":[{"version":".NET 8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:56:54.872156Z","id":"CVE-2026-105444","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-99"}]}],"references":[{"url":"https://github.com/dotnet/eShop/","source":"cna@vuldb.com"},{"url":"https://github.com/dotnet/eShop/issues/996","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105444","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/984283","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413608","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413608/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105447","sourceIdentifier":"secalert@redhat.com","published":"2026-10-05T21:16:34.650","lastModified":"2026-10-08T03:16:33.487","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the build trigger API to retrieve these delegate tokens. This issue allows a restricted user to bypass read-only limitations and push arbitrary container images to private repositories, leading to privilege escalation."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Quay 3","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quay/quay-rhel8","cpes":["cpe:/a:redhat:quay:3"]},{"vendor":"Red Hat","product":"Red Hat Quay 3","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quay/quay-rhel9","cpes":["cpe:/a:redhat:quay:3"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:25:25.362841Z","id":"CVE-2026-105447","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-105447","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545916","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-105697","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T21:16:35.087","lastModified":"2026-10-09T20:17:09.307","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c \"exec {command} ...\". Any user able to reach the MCP server settings (\"Settings → MCP Servers → Add MCP Server\", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a \"server\" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow) — even when the UI then reports that the stdio server failed to start. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token without credentials, so on an exposed instance running the default configuration this is reachable without an account. AUTO_LOGIN is documented as a development-only setting; with it disabled, any authenticated (non-admin) user can exploit it. This issue is fixed in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"langflow-ai","product":"langflow","versions":[{"version":">= 1.1.2, < 1.10.3","status":"affected"}]},{"vendor":"langflow-ai","product":"langflow-base","versions":[{"version":">= 0.1.2, < 0.10.3","status":"affected"}]},{"vendor":"langflow-ai","product":"lfx","versions":[{"version":"< 1.10.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:36:02.678305Z","id":"CVE-2026-105697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/langflow-ai/langflow/commit/eba285edf1dd4a33bf23a9cb8113c991fcdf3d1d","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/pull/12290","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/pull/14036","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/releases/tag/v1.10.3","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45","source":"security-advisories@github.com"},{"url":"https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem","source":"security-advisories@github.com"},{"url":"https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105698","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T21:16:35.257","lastModified":"2026-10-06T14:59:48.280","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers. Through version 1.7.1, an unauthenticated caller who knew another user's flow UUID could reach these handlers; from version 1.7.2 through 1.10.0, callers had to authenticate but needed no elevated privileges. Such a caller could cause retrieve_vertices_order to load and cache the private graph, enumerate its vertex identifiers, and use build_vertex to execute selected vertices and receive their results. build_graph_from_db_no_cache performed a primary-key lookup without an owner filter. This could disclose private flow structure, configured values, and selected outputs and could trigger victim-configured side effects and build-history records, although it did not expose the victim's variable-store credentials or permit modification of the stored flow. This issue is fixed in Langflow 1.10.1 and langflow-base 0.10.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"langflow-ai","product":"langflow","versions":[{"version":">= 1.0.0, < 1.10.1","status":"affected"}]},{"vendor":"langflow-ai","product":"langflow-base","versions":[{"version":"< 0.10.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:58:15.330352Z","id":"CVE-2026-105698","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/langflow-ai/langflow/commit/fb3d6ec90b1e4d52eaa40915a64b1f86b6542f55","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/pull/13153","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/releases/tag/v1.10.1","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105699","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T21:16:35.410","lastModified":"2026-10-08T03:16:34.637","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. read_resource forwarded the attacker-controlled URI to handle_read_resource, which parsed a flow_id and filename and called storage_service.get_file without verifying that the flow belonged to the authenticated user or current project. A user with access to any project-scoped MCP endpoint could therefore request another user's flow-backed file, while global handle_list_resources and handle_list_tools behavior could disclose flow and file identifiers that made targeting easier. The vulnerability disclosed uploaded documents, structured data, prompts, and other private flow artifacts across tenants but did not modify victim files or stored flows. This issue is fixed in version 1.9.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"langflow-ai","product":"langflow","versions":[{"version":">= 1.6.8, <= 1.9.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:26:20.768713Z","id":"CVE-2026-105699","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/langflow-ai/langflow/commit/b8fe970493fd5fb2e1fc71dfccc79f90b76058fa","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/commit/f0fd436fe9829192ee550e6cb46961a01dd37032","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/pull/12818","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/releases/tag/v1.9.1","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-4hmc-cfm3-w43c","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-4hmc-cfm3-w43c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105740","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T21:16:35.567","lastModified":"2026-10-06T19:17:41.197","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the \"Stdio\" transport. The user-supplied command field is passed directly to bash -c \"exec {command}\" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"langflow-ai","product":"langflow","versions":[{"version":"< 1.9.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:20:20.481095Z","id":"CVE-2026-105740","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/pull/12290","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105741","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T21:16:35.740","lastModified":"2026-10-06T17:17:18.810","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the \"local-only\" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"langflow-ai","product":"langflow","versions":[{"version":">= 1.5.0, < 1.10.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:42:30.466213Z","id":"CVE-2026-105741","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"},{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://github.com/langflow-ai/langflow/commit/1f39a4b9d62c9dfa1b21fa7f85e23a180c351b72","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/pull/13915","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/releases/tag/v1.10.3","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-4f6c-2vvp-gw82","source":"security-advisories@github.com"},{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-4f6c-2vvp-gw82","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-105768","sourceIdentifier":"82cea9a6-e9e3-46fe-bdb0-3673de380178","published":"2026-10-05T21:16:35.913","lastModified":"2026-10-06T14:17:39.657","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.Atoi and convert them to uint32 without a range check. On 64-bit platforms an out-of-range value such as 4294967296 (2^32) is truncated to 0, and negative values wrap. Because apko parses the passwd and group entries supplied by the packages it installs and writes them back into the image, an attacker who controls a package installed into the image can ship an entry that appears to declare an unprivileged UID or GID but is written into the built image as UID 0 or GID 0 (root). The truncated UID is also used when resolving the image's run-as user. This issue has been fixed in version 1.4.5."}],"affected":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","affectedData":[{"vendor":"chainguard-dev","product":"apko","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"chainguard.dev/apko","modules":["pkg/passwd"],"programFiles":["pkg/passwd/passwd.go","pkg/passwd/group.go"],"programRoutines":[{"name":"passwd.UserEntry.Parse"},{"name":"passwd.GroupEntry.Parse"}],"repo":"https://github.com/chainguard-dev/apko","versions":[{"version":"0.2.0","lessThan":"1.4.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:59:21.787962Z","id":"CVE-2026-105768","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"82cea9a6-e9e3-46fe-bdb0-3673de380178","type":"Secondary","description":[{"lang":"en","value":"CWE-197"}]}],"references":[{"url":"https://github.com/chainguard-dev/apko/commit/739e7ce3f675ffb232e16849b51ff93657f1570c","source":"82cea9a6-e9e3-46fe-bdb0-3673de380178"},{"url":"https://github.com/chainguard-dev/apko/pull/2516","source":"82cea9a6-e9e3-46fe-bdb0-3673de380178"},{"url":"https://github.com/chainguard-dev/apko/releases/tag/v1.4.5","source":"82cea9a6-e9e3-46fe-bdb0-3673de380178"},{"url":"https://github.com/chainguard-dev/apko/security/advisories/GHSA-rj6x-hwpv-vhvf","source":"82cea9a6-e9e3-46fe-bdb0-3673de380178"}]}},{"cve":{"id":"CVE-2026-105773","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-10-05T21:16:36.093","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Canimaan Software","product":"ClamXAV","defaultStatus":"affected","versions":[{"version":"3.3","lessThan":"3.11.1","versionType":"custom","status":"affected"},{"version":"3.11.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"timestamp":"2026-10-02T16:39:10.719080Z","id":"CVE-2026-105773","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://clamxav.com/version-history","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-278-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105773","source":"9119a7d8-5eab-497f-8521-727c672e3725"}]}},{"cve":{"id":"CVE-2026-77226","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-05T21:16:37.337","lastModified":"2026-10-07T17:17:02.300","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to call the setup user-create endpoint and create a new administrator account when the camunda-admin group is empty but the system is fully administered, resulting in account takeover and potential process deployment or script execution as the engine's service user."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Camunda","product":"Camunda 7","defaultStatus":"unaffected","versions":[{"version":"7.24.0","lessThan":"7.24.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-07T16:08:46.557560Z","id":"CVE-2026-77226","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://codeant.ai/security-research/camunda-empty-admin-group-cve-2026-77226","source":"disclosure@vulncheck.com"},{"url":"https://docs.camunda.org/enterprise/download/","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/camunda-incorrect-authorization-via-setupresource-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-84900","sourceIdentifier":"hp-security-alert@hp.com","published":"2026-10-05T21:16:37.747","lastModified":"2026-10-06T15:15:48.310","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.1 SP10, which includes updates to mitigate potential vulnerabilities. \nPrevious versions of HP ThinPro (prior to HP ThinPro 9 SP3) could potentially contain security vulnerabilities. HP has released HP ThinPro 9 SP3, which includes updates to mitigate potential vulnerabilities."}],"affected":[{"source":"hp-security-alert@hp.com","affectedData":[{"vendor":"HP Inc","product":"ThinPro 8.1","defaultStatus":"unaffected","platforms":["Linux"],"versions":[{"version":"0","lessThan":"ThinPro 8.1 SP10","versionType":"custom","status":"affected"}]},{"vendor":"HP Inc","product":"ThinPro 9","defaultStatus":"unaffected","platforms":["Linux"],"versions":[{"version":"0","lessThan":"ThinPro 9 SP3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"hp-security-alert@hp.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:57:40.682017Z","id":"CVE-2026-84900","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"hp-security-alert@hp.com","type":"Secondary","description":[{"lang":"en","value":"CWE-354"}]}],"references":[{"url":"https://support.hp.com/us-en/document/ish_15735991-15736015-16/hpsbhf04155","source":"hp-security-alert@hp.com"},{"url":"https://support.hp.com/us-en/document/ish_15736095-15736118-16/hpsbhf04154","source":"hp-security-alert@hp.com"}]}},{"cve":{"id":"CVE-2026-93326","sourceIdentifier":"security@docker.com","published":"2026-10-05T21:16:37.907","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for example based on commit SHA, commit data, or signatures, then all these validations still apply correctly."}],"affected":[{"source":"security@docker.com","affectedData":[{"vendor":"moby","product":"BuildKit","defaultStatus":"unaffected","packageName":"github.com/moby/buildkit","versions":[{"version":"0","lessThanOrEqual":"0.33.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@docker.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:48:15.390037Z","id":"CVE-2026-93326","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@docker.com","type":"Secondary","description":[{"lang":"en","value":"CWE-180"}]}],"references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.33.1","source":"security@docker.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-66hf-6vf5-87hc","source":"security@docker.com"}]}},{"cve":{"id":"CVE-2026-0461","sourceIdentifier":"psirt@amd.com","published":"2026-10-05T22:16:55.280","lastModified":"2026-10-06T16:00:36.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system."}],"affected":[{"source":"psirt@amd.com","affectedData":[{"vendor":"AMD","product":"Zynq™ UltraScale+ MPSoCs","defaultStatus":"affected","versions":[{"version":"2026.1","status":"unaffected"}]},{"vendor":"AMD","product":"Zynq™ UltraScale+ RFSoCs","defaultStatus":"affected","versions":[{"version":"2026.1","status":"unaffected"}]},{"vendor":"AMD","product":"Kria SOMs","defaultStatus":"affected","versions":[{"version":"2026.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@amd.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:48:53.434055Z","id":"CVE-2026-0461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@amd.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8029.html","source":"psirt@amd.com"}]}},{"cve":{"id":"CVE-2026-0482","sourceIdentifier":"psirt@amd.com","published":"2026-10-05T22:16:56.210","lastModified":"2026-10-06T16:00:36.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This condition could lead to potential impacts on confidentiality, integrity, and availability."}],"affected":[{"source":"psirt@amd.com","affectedData":[{"vendor":"AMD","product":"Alveo™ Accelerator Cards","defaultStatus":"affected","versions":[{"version":"2026.1","status":"unaffected"}]},{"vendor":"AMD","product":"Versal™ Prime Series Adaptive SoCs","defaultStatus":"affected","versions":[{"version":"2026.1","status":"unaffected"}]},{"vendor":"AMD","product":"Versal™ Premium Series Adaptive SoCs","defaultStatus":"affected","versions":[{"version":"2026.1","status":"unaffected"}]},{"vendor":"AMD","product":"Versal™ AI Edge Series Adaptive SoCs","defaultStatus":"affected","versions":[{"version":"2026.1","status":"unaffected"}]},{"vendor":"AMD","product":"Versal™ AI Core Series Adaptive SoCs","defaultStatus":"affected","versions":[{"version":"2026.1","status":"unaffected"}]},{"vendor":"AMD","product":"Versal™ HBM Series Adaptive SoCs","defaultStatus":"affected","versions":[{"version":"2026.1","status":"unaffected"}]},{"vendor":"AMD","product":"Versal™ RF Series Adaptive SoCs","defaultStatus":"affected","versions":[{"version":"2026.1","status":"unaffected"}]},{"vendor":"AMD","product":"Versal Premium Series Gen 2 Adaptive SOCs (2VP3402, 2VP3502, 2VP3602)","defaultStatus":"affected","versions":[{"version":"2026.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@amd.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:49:17.250867Z","id":"CVE-2026-0482","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@amd.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8028.html","source":"psirt@amd.com"}]}},{"cve":{"id":"CVE-2026-103433","sourceIdentifier":"security@docker.com","published":"2026-10-05T22:16:56.370","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected."}],"affected":[{"source":"security@docker.com","affectedData":[{"vendor":"Docker","product":"Docker Buildx","defaultStatus":"unaffected","platforms":["Linux","MacOS","Windows"],"versions":[{"version":"0","lessThan":"0.37.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@docker.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:35:43.962848Z","id":"CVE-2026-103433","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@docker.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://docs.docker.com/build/bake/reference/#targetentitlements","source":"security@docker.com"},{"url":"https://github.com/docker/buildx","source":"security@docker.com"},{"url":"https://github.com/docker/buildx/releases/tag/v0.37.2","source":"security@docker.com"},{"url":"https://github.com/docker/buildx/security/advisories/GHSA-p54p-jq4x-rc28","source":"security@docker.com"}]}},{"cve":{"id":"CVE-2026-103546","sourceIdentifier":"cna@mongodb.com","published":"2026-10-05T22:16:56.520","lastModified":"2026-10-06T16:00:36.547","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB, Inc.","product":"Mongodb Controllers for Kubernetes","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.13.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:36:24.124063Z","id":"CVE-2026-103546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/mongodb/mongodb-kubernetes/releases/tag/1.13.0","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-105468","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T22:16:56.683","lastModified":"2026-10-08T03:16:33.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"girishsaraf","product":"Online-Appointment-Booking-System","cpes":["cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"],"modules":["Login Handler"],"versions":[{"version":"f427b4757128ca253d33d0cc4e87bbb9c999a4d5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:29:53.855589Z","id":"CVE-2026-105468","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/","source":"cna@vuldb.com"},{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/6","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105468","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/984333","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413614","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413614/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105742","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T22:16:56.867","lastModified":"2026-10-07T19:52:37.513","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required. This issue is fixed in 2.132.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docling-project","product":"docling","versions":[{"version":">= 2.95.0, < 2.132.0","status":"affected"}]},{"vendor":"docling-project","product":"docling-slim","versions":[{"version":">= 2.95.0, < 2.132.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:54:47.744121Z","id":"CVE-2026-105742","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"},{"lang":"en","value":"CWE-522"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*","versionStartIncluding":"2.95.0","versionEndExcluding":"2.132.0","matchCriteriaId":"A6315BB7-9E47-4EDE-B6FD-609919DAB18C"}]}]}],"references":[{"url":"https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/docling-project/docling/pull/4420","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.132.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105743","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T22:16:57.030","lastModified":"2026-10-08T03:16:34.960","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetching to be enabled, and response content is exposed only when it is decoded as an image or passively rendered in a page screenshot. This issue is fixed in 2.132.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docling-project","product":"docling","versions":[{"version":">= 2.91.0, < 2.132.0","status":"affected"}]},{"vendor":"docling-project","product":"docling-slim","versions":[{"version":">= 2.91.0, < 2.132.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":4.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:28:00.752216Z","id":"CVE-2026-105743","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*","versionStartIncluding":"2.91.0","versionEndExcluding":"2.132.0","matchCriteriaId":"E8BA5E7B-FE81-4207-8457-737EF5D4866A"}]}]}],"references":[{"url":"https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/docling-project/docling/pull/4420","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.132.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-pc36-qwjq-x68c","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105744","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T22:16:57.177","lastModified":"2026-10-07T19:33:16.747","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine=\"tectonic\") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \\openin and \\openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tectonic rendering, is not affected. This vulnerability is fixed in 2.132.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docling-project","product":"docling","versions":[{"version":">= 2.94.0, < 2.132.0","status":"affected"}]},{"vendor":"docling-project","product":"docling-slim","versions":[{"version":">= 2.94.0, < 2.132.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:16:04.154757Z","id":"CVE-2026-105744","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-1188"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*","versionStartIncluding":"2.94.0","versionEndExcluding":"2.132.0","matchCriteriaId":"61AE8391-BA99-4DF2-900A-C046E9CCC9A6"}]}]}],"references":[{"url":"https://github.com/docling-project/docling/commit/38b6fa0a465d46fdacbbec333f50fa19c4f6b342","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/docling-project/docling/pull/4419","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.132.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j","source":"security-advisories@github.com","tags":["Mitigation","Patch","Vendor Advisory","Exploit"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Mitigation","Patch","Vendor Advisory","Exploit"]}]}},{"cve":{"id":"CVE-2026-105745","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T22:16:57.330","lastModified":"2026-10-07T19:18:20.837","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed third-party or compromised package can therefore execute import-time code when Docling starts, while the subsequent namespace filter misleadingly reports that the plugin was not loaded. This issue is fixed in 2.131.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docling-project","product":"docling","versions":[{"version":">= 2.27.0, < 2.131.0","status":"affected"}]},{"vendor":"docling-project","product":"docling-slim","versions":[{"version":">= 2.27.0, < 2.131.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:35:59.694379Z","id":"CVE-2026-105745","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-696"},{"lang":"en","value":"CWE-829"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*","versionStartIncluding":"2.27.0","versionEndExcluding":"2.131.0","matchCriteriaId":"E95525D7-49E6-4125-853E-2ECACFBB1CD8"}]}]}],"references":[{"url":"https://github.com/docling-project/docling/commit/0f443b3786e98688a2da3b7c8f56fe5e46af876c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/docling-project/docling/pull/4413","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.131.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-9jxx-vjrv-h2rq","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105746","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T22:16:57.480","lastModified":"2026-10-07T19:02:09.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checking the pipeline_options.enable_remote_services setting, even when the caller sets that policy control to false. The StandardPdfPipeline._make_ocr_model method also fails to pass the flag into the OCR factory, allowing remote OCR processing in configurations that rely on remote services being disabled. The destination is configured by the caller rather than selected by an attacker. This issue is fixed in 2.131.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docling-project","product":"docling","versions":[{"version":">= 2.83.0, < 2.131.0","status":"affected"}]},{"vendor":"docling-project","product":"docling-slim","versions":[{"version":">= 2.83.0, < 2.131.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.2,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:40:03.192704Z","id":"CVE-2026-105746","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-668"},{"lang":"en","value":"CWE-693"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*","versionStartIncluding":"2.83.0","versionEndExcluding":"2.131.0","matchCriteriaId":"E5AB4D0B-A98B-466F-8FA2-63E9D082D08F"}]}]}],"references":[{"url":"https://github.com/docling-project/docling/commit/7d6d0c4810dff4885017c53890be6dc5a22ca68b","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/docling-project/docling/pull/4418","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.131.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-h42j-9hcc-3cwc","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105747","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T22:16:57.633","lastModified":"2026-10-07T18:54:39.350","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_backend.py call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can therefore consume memory proportional to the declared member count, including during format detection before the allowed_formats restriction is applied. This issue is a residual weakness in the member-count protection added for CVE-2026-44018. This issue is fixed in 2.131.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docling-project","product":"docling","versions":[{"version":">= 2.45.0, < 2.131.0","status":"affected"}]},{"vendor":"docling-project","product":"docling-slim","versions":[{"version":">= 2.45.0, < 2.131.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:13.770203Z","id":"CVE-2026-105747","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-409"},{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*","versionStartIncluding":"2.45.0","versionEndExcluding":"2.131.0","matchCriteriaId":"0C056F86-D184-4241-B795-2626129F2717"}]}]}],"references":[{"url":"https://github.com/docling-project/docling/commit/ebae65cd71c37c88b36185b406a449b92d8f7ffa","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/docling-project/docling/pull/4412","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.131.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-3cr3-8m4c-fpxw","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105748","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T22:16:57.793","lastModified":"2026-10-07T18:47:00.463","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument input without rejecting picture image references that contain local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, the DoclingDocument._with_embedded_pictures and ImageRef.pil_image methods can open those references and place readable image bytes in Markdown or HTML output. Disclosure is limited to files Pillow can decode as images, while differing decode behavior can also reveal whether a path exists. Direct untrusted loading through docling-core is outside this Docling fix. This issue is fixed in 2.131.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docling-project","product":"docling","versions":[{"version":">= 2.16.0, < 2.131.0","status":"affected"}]},{"vendor":"docling-project","product":"docling-slim","versions":[{"version":">= 2.16.0, < 2.131.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:16:57.407957Z","id":"CVE-2026-105748","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*","versionStartIncluding":"2.16.0","versionEndExcluding":"2.131.0","matchCriteriaId":"EF1ED8A9-3F7C-487E-84A7-1F1DEAB7000F"}]}]}],"references":[{"url":"https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/docling-project/docling/pull/4417","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.131.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105749","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T22:16:57.943","lastModified":"2026-10-08T03:16:35.093","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docling-project","product":"docling","versions":[{"version":">= 2.0.0, < 2.131.0","status":"affected"}]},{"vendor":"docling-project","product":"docling-slim","versions":[{"version":">= 2.92.0, < 2.131.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:28:41.797887Z","id":"CVE-2026-105749","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-789"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.131.0","matchCriteriaId":"06283271-0264-48A3-B1C2-DCA994108840"}]}]}],"references":[{"url":"https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/docling-project/docling/pull/4414","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.131.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105750","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T22:16:58.097","lastModified":"2026-10-07T17:52:51.153","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docling-project","product":"docling","versions":[{"version":">= 2.82.0, < 2.118.1","status":"affected"}]},{"vendor":"docling-project","product":"docling-slim","versions":[{"version":">= 2.92.0, < 2.118.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T18:17:20.609974Z","id":"CVE-2026-105750","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-552"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*","versionStartIncluding":"2.82.0","versionEndExcluding":"2.118.1","matchCriteriaId":"6C5BACD1-2992-465D-93E2-1C62FE28279D"}]}]}],"references":[{"url":"https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/docling-project/docling/pull/3948","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.118.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105751","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T22:16:58.253","lastModified":"2026-10-16T20:45:30.910","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docling-project","product":"docling","versions":[{"version":">= 2.107.0, < 2.120.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:32:19.946260Z","id":"CVE-2026-105751","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*","versionStartIncluding":"2.107.0","versionEndExcluding":"2.120.3","matchCriteriaId":"E120569F-3BBF-429E-BB46-EB2C3519F610"}]}]}],"references":[{"url":"https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/docling-project/docling/pull/4015","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.120.3","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-21589","sourceIdentifier":"security@atlassian.com","published":"2026-10-05T22:16:58.423","lastModified":"2026-10-19T20:31:57.050","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents."}],"affected":[{"source":"security@atlassian.com","affectedData":[{"vendor":"Atlassian","product":"Bamboo Data Center","versions":[{"version":"All other versions","status":"affected"},{"version":"Patch version 10.2.24 and later","status":"unaffected"},{"version":"Patch version 12.1.12 and later","status":"unaffected"}]},{"vendor":"Atlassian","product":"Bitbucket Data Center","versions":[{"version":"All other versions","status":"affected"},{"version":"Patch version 10.2.8 and later","status":"unaffected"},{"version":"Patch version 10.5.1 and later","status":"unaffected"},{"version":"Patch version 9.4.26 and later","status":"unaffected"}]},{"vendor":"Atlassian","product":"Confluence Data Center","versions":[{"version":"All other versions","status":"affected"},{"version":"Patch version 10.2.19 and later","status":"unaffected"},{"version":"Patch version 9.2.26 and later","status":"unaffected"}]},{"vendor":"Atlassian","product":"Crowd Data Center","versions":[{"version":"All other versions","status":"affected"},{"version":"Patch version 7.2.4 and later","status":"unaffected"},{"version":"Patch version 7.1.7 and later","status":"unaffected"},{"version":"Patch version 7.0.3 and later","status":"unaffected"},{"version":"Patch version 6.3.7 and later","status":"unaffected"}]},{"vendor":"Atlassian","product":"Crucible Data Center","versions":[{"version":"All other versions","status":"affected"},{"version":"Patch version 4.9.15 and later","status":"unaffected"}]},{"vendor":"Atlassian","product":"Fisheye Data Center","versions":[{"version":"All other versions","status":"affected"},{"version":"Patch version 4.9.15 and later","status":"unaffected"}]},{"vendor":"Atlassian","product":"Jira Service Management Data Center","versions":[{"version":"All other versions","status":"affected"},{"version":"Patch version 11.3.12 and later","status":"unaffected"},{"version":"Patch version 10.3.26 and later","status":"unaffected"},{"version":"Patch version 5.12.40 and later","status":"unaffected"}]},{"vendor":"Atlassian","product":"Jira Software Data Center","versions":[{"version":"All other versions","status":"affected"},{"version":"Patch version 11.3.12 and later","status":"unaffected"},{"version":"Patch version 10.3.26 and later","status":"unaffected"},{"version":"Patch version 9.12.40 and later","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@atlassian.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T00:00:00+00:00","id":"CVE-2026-21589","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-10-15","cisaActionDue":"2026-10-18","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-552"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"7.17.0","versionEndExcluding":"9.4.26","matchCriteriaId":"7F95E74C-C2B5-4527-9282-A9C1E6FE2770"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"9.5.0","versionEndExcluding":"10.2.8","matchCriteriaId":"4489C580-A184-45F2-945A-74919B30770E"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:bitbucket_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"10.3.0","versionEndExcluding":"10.5.1","matchCriteriaId":"FC3E298E-8B85-4EE6-B5BD-B9D2ECE4ACF4"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:bitbucket_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6.0","versionEndIncluding":"8.14.6","matchCriteriaId":"6C615C3F-17A8-4458-88C1-342B973C0FB1"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.0","versionEndExcluding":"9.2.26","matchCriteriaId":"E935B10B-F918-41C0-890D-DB9058BC503B"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"9.3.0","versionEndExcluding":"10.2.19","matchCriteriaId":"8ABC2EDD-401B-4065-98CA-1D6AFE8C48E7"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*","versionStartIncluding":"2.11.0","versionEndExcluding":"6.3.7","matchCriteriaId":"D7704951-4EDF-4ADD-BF1F-0E74302B4D15"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.3","matchCriteriaId":"0C6C0576-C6B8-4B7B-A3AF-2F49C07CD087"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1.0","versionEndExcluding":"7.1.7","matchCriteriaId":"2DDBD17E-7209-4402-81E0-C3A77D9BADC6"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2.0","versionEndExcluding":"7.2.4","matchCriteriaId":"A00677AE-D4A9-486C-8D5B-FAC4CD68F17E"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1.0","versionEndExcluding":"9.12.40","matchCriteriaId":"8C2734C1-0626-4C2B-8E7E-1E5744931699"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"9.13.0","versionEndExcluding":"10.3.26","matchCriteriaId":"13B7AADD-EE93-4BE5-A12A-FC69F024276D"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*","versionStartIncluding":"10.4.0","versionEndExcluding":"11.3.12","matchCriteriaId":"585E5684-41A5-4882-BBE6-8CC388162DC6"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*","versionStartIncluding":"3.1.0","versionEndIncluding":"4.13.27","matchCriteriaId":"96833142-C39A-4BEF-B636-E013C5FBF1E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*","versionStartIncluding":"4.14.0","versionEndExcluding":"5.12.40","matchCriteriaId":"B53D3DC2-160F-4A58-A371-AEE4A4D2EBCA"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*","versionStartIncluding":"5.13.0","versionEndExcluding":"10.3.26","matchCriteriaId":"EAB2D1C1-8AF2-49EE-AD67-5B489BD4BD6A"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*","versionStartIncluding":"10.4.0","versionEndExcluding":"11.3.12","matchCriteriaId":"7166EDE8-5D90-4B90-B770-0DBD581D10E9"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.1","versionEndExcluding":"10.2.24","matchCriteriaId":"9E8447C5-5177-4BC0-86E5-CCF9339B6C74"},{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*","versionStartIncluding":"11.0.0","versionEndExcluding":"12.1.12","matchCriteriaId":"7355838B-DA4B-4399-BA98-D97CBA4F45A0"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.15","matchCriteriaId":"157CCC63-800B-46BD-AE83-9F8C8CC481FE"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.15","matchCriteriaId":"74B7DE64-7D30-4076-983A-D9814AC90B3A"}]}]}],"references":[{"url":"https://jira.atlassian.com/browse/BAM-26567","source":"security@atlassian.com","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/BSERV-20604","source":"security@atlassian.com","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/CONFSERVER-104488","source":"security@atlassian.com","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/CRUC-8741","source":"security@atlassian.com","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/CWD-6610","source":"security@atlassian.com","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/FE-7583","source":"security@atlassian.com","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/JRASERVER-79546","source":"security@atlassian.com","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://jira.atlassian.com/browse/JSDSERVER-16809","source":"security@atlassian.com","tags":["Issue Tracking","Mitigation","Vendor Advisory"]},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}},{"cve":{"id":"CVE-2026-91107","sourceIdentifier":"help@fluidattacks.com","published":"2026-10-05T22:16:58.657","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password."}],"affected":[{"source":"help@fluidattacks.com","affectedData":[{"vendor":"OS4ED","product":"openSIS-Classic","defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"versions":[{"version":"9.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"help@fluidattacks.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:53:53.280988Z","id":"CVE-2026-91107","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"help@fluidattacks.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://fluidattacks.com/advisories/hearts","source":"help@fluidattacks.com"},{"url":"https://github.com/OS4ED/openSIS-Classic","source":"help@fluidattacks.com"},{"url":"https://github.com/OS4ED/openSIS-Classic/commit/24bb530391a67c114cd4fe3dff65da7e070f5ed1","source":"help@fluidattacks.com"}]}},{"cve":{"id":"CVE-2026-93315","sourceIdentifier":"security@docker.com","published":"2026-10-05T22:16:58.820","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build."}],"affected":[{"source":"security@docker.com","affectedData":[{"vendor":"moby","product":"BuildKit","defaultStatus":"unaffected","packageName":"github.com/moby/buildkit","platforms":["Linux"],"versions":[{"version":"0.31.0","lessThan":"0.33.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@docker.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:26:31.480821Z","id":"CVE-2026-93315","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@docker.com","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.33.1","source":"security@docker.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-2f5p-x9ph-g97x","source":"security@docker.com"}]}},{"cve":{"id":"CVE-2026-93321","sourceIdentifier":"security@docker.com","published":"2026-10-05T22:16:58.960","lastModified":"2026-10-06T15:08:38.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A malicious frontend can submit an LLB definition that causes buildkitd\nto panic and terminate, interrupting all builds running on that daemon."}],"affected":[{"source":"security@docker.com","affectedData":[{"vendor":"moby","product":"BuildKit","defaultStatus":"unaffected","packageName":"github.com/moby/buildkit","versions":[{"version":"0","lessThanOrEqual":"0.33.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@docker.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:25:14.458482Z","id":"CVE-2026-93321","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@docker.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"references":[{"url":"https://github.com/moby/buildkit/releases/tag/v0.33.1","source":"security@docker.com"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-fjj4-h6vf-m9hj","source":"security@docker.com"}]}},{"cve":{"id":"CVE-2026-104852","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T23:17:00.213","lastModified":"2026-10-06T15:17:13.110","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, constructor, or prototype keys. An unauthenticated GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process until restart. This issue is fixed in version 12.0.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"ardatan","product":"graphql-tools","versions":[{"version":"< 12.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:12.166588Z","id":"CVE-2026-104852","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e","source":"security-advisories@github.com"},{"url":"https://github.com/ardatan/graphql-tools/pull/8423","source":"security-advisories@github.com"},{"url":"https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.1","source":"security-advisories@github.com"},{"url":"https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv","source":"security-advisories@github.com"},{"url":"https://github.com/graphql-hive/gateway/pull/2600","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-105469","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T23:17:01.320","lastModified":"2026-10-06T17:17:17.770","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file get_town.php of the component AJAX Endpoint. Executing a manipulation of the argument countryid/townid/cid/didval/cidval can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"girishsaraf","product":"Online-Appointment-Booking-System","cpes":["cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"],"modules":["AJAX Endpoint"],"versions":[{"version":"f427b4757128ca253d33d0cc4e87bbb9c999a4d5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T16:29:22.575940Z","id":"CVE-2026-105469","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/","source":"cna@vuldb.com"},{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/7","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105469","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/984335","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413615","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413615/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105470","sourceIdentifier":"cna@vuldb.com","published":"2026-10-05T23:17:01.520","lastModified":"2026-10-06T18:16:45.500","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_query of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"girishsaraf","product":"Online-Appointment-Booking-System","cpes":["cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"],"modules":["Doctor Search Endpoint"],"versions":[{"version":"f427b4757128ca253d33d0cc4e87bbb9c999a4d5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:06:32.251647Z","id":"CVE-2026-105470","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/","source":"cna@vuldb.com"},{"url":"https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/8","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-105470","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/984336","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413616","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/413616/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-105752","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T23:17:01.710","lastModified":"2026-10-08T01:29:51.587","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through \"POST /v1/responses\" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating the intended tenant isolation of salted prefix caching. This issue is fixed in version 0.30.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vllm-project","product":"vllm","versions":[{"version":"< 0.30.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:12.970594Z","id":"CVE-2026-105752","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-524"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.30.0","matchCriteriaId":"C81A0CA6-3CD2-4289-A4F1-29381ADFA804"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/commit/6a2a2bb02b563b83f946012959fd3927984d072a","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/50195","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/51818","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.30.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-935w-9g4m-p28p","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105753","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T23:17:01.867","lastModified":"2026-10-08T01:29:33.007","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if that request is rejected. A later request reusing the same media hash causes MultiModalProcessorSenderCache to send no payload and MultiModalReceiverCache to reach an assertion with the message \"Expected a cached item,\" producing a shared-service availability failure. This issue is fixed in version 0.28.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vllm-project","product":"vllm","versions":[{"version":"< 0.28.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:21:53.802331Z","id":"CVE-2026-105753","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-617"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.28.0","matchCriteriaId":"348E22A1-F884-4209-9464-6ACE00818B2F"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/commit/396204230423b7cc6798300926b8fa30190d26a9","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/46747","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/51897","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.28.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-ph3r-5jfg-f84f","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105754","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T23:17:02.017","lastModified":"2026-10-08T03:16:35.230","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the features.mm_placeholders field, and wire-selected multimodal field processors without rebinding them to the active model renderer contract. Forged grid geometry, field types, or non-positive placeholder lengths can terminate the shared EngineCore; when an attacker knows or can induce a victim's content hash, forged cache hashes can poison or retrieve cross-request encoder-cache state; and dropped sparse placeholder masks can alter replayed transport semantics. This issue is fixed in version 0.30.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vllm-project","product":"vllm","versions":[{"version":"< 0.30.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:31:20.281715Z","id":"CVE-2026-105754","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-617"},{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-668"},{"lang":"en","value":"CWE-704"},{"lang":"en","value":"CWE-1284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.30.0","matchCriteriaId":"C81A0CA6-3CD2-4289-A4F1-29381ADFA804"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/commit/1970f3ed4be7fa8620e4ddc4a12c36a8384cfc27","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/51898","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.30.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-ph72-cqr5-qpp7","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105755","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T23:17:02.167","lastModified":"2026-10-08T01:28:50.393","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding so the victim's documents are scored against the attacker's query, and shared use counters can also cause a late-interaction cache-miss error. This issue is fixed in version 0.30.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vllm-project","product":"vllm","versions":[{"version":"< 030.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:55:11.724369Z","id":"CVE-2026-105755","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.30.0","matchCriteriaId":"C81A0CA6-3CD2-4289-A4F1-29381ADFA804"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/commit/ee17d0d869203ef9a35ad73358a4987bba14b1fc","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/51445","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.30.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-2phq-3phc-84px","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105756","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T23:17:02.317","lastModified":"2026-10-08T01:28:23.010","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vllm-project","product":"vllm","versions":[{"version":"< 0.30.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:41:36.857213Z","id":"CVE-2026-105756","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-248"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.30.0","matchCriteriaId":"C81A0CA6-3CD2-4289-A4F1-29381ADFA804"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/commit/e962733e08d10f7ca65dac4df99e116460b8b174","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/51444","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.30.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-2823-qmq8-rwvj","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105757","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T23:17:02.467","lastModified":"2026-10-08T01:28:00.630","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vllm-project","product":"vllm","versions":[{"version":"< 0.30.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T13:20:12.110559Z","id":"CVE-2026-105757","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-248"},{"lang":"en","value":"CWE-755"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.30.0","matchCriteriaId":"C81A0CA6-3CD2-4289-A4F1-29381ADFA804"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/commit/c55e15a44ec4127832d4a86928a356fdd9e68dbd","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/51450","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.30.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-85xf-c7hm-whqw","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105758","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T23:17:02.610","lastModified":"2026-10-08T03:16:35.407","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields without enforcing server-side ceilings. An unauthenticated caller can submit these values to the /tokenize endpoint, causing the sampler to decode every frame selected from attacker-controlled video input, consume disproportionate frontend memory, and potentially terminate the API process before scheduling or admission control. The Rust frontend is not affected because it rejects the media_io_kwargs field. This issue is fixed in version 0.30.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vllm-project","product":"vllm","versions":[{"version":">= 0.24.0, < 0.30.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T02:32:16.874942Z","id":"CVE-2026-105758","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionStartIncluding":"0.24.0","versionEndExcluding":"0.30.0","matchCriteriaId":"288D540F-FDB8-459E-91CA-16D01A756A63"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/commit/ea723c81c3ea26425cb69503a5d5e90822a04a45","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/56729","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.30.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-x6mc-67gf-chw4","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105759","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T23:17:02.760","lastModified":"2026-10-16T20:41:27.840","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vllm-project","product":"vllm","versions":[{"version":"< 0.30.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T17:56:34.732350Z","id":"CVE-2026-105759","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionEndExcluding":"0.30.0","matchCriteriaId":"C81A0CA6-3CD2-4289-A4F1-29381ADFA804"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/commit/3735c2d5f5248259482b9045c34fb7a8a3892352","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/56058","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.30.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-5fj9-pfhr-6j48","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-5fj9-pfhr-6j48","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105760","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T23:17:02.903","lastModified":"2026-10-16T20:39:54.097","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work ceiling. GLMGA constructs and deduplicates an attacker-sized pre-decode frame-index list, allowing a compact request and tiny valid video to consume disproportionate CPU time and memory in the shared media-loading executor. This issue is fixed in version 0.30.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"vllm-project","product":"vllm","versions":[{"version":">= 0.23.0rc2, < 0.30.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:38:28.658453Z","id":"CVE-2026-105760","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*","versionStartIncluding":"0.23.0","versionEndExcluding":"0.30.0","matchCriteriaId":"EF515F5D-C23A-4F8D-BF22-864E2A92BA0E"}]}]}],"references":[{"url":"https://github.com/vllm-project/vllm/commit/8b6de0eb9a09ef53f20cf06bd4d17ee264b9c2a7","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/vllm-project/vllm/pull/54935","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/vllm-project/vllm/releases/tag/v0.30.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-58v5-2m8f-94pr","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-105761","sourceIdentifier":"security-advisories@github.com","published":"2026-10-05T23:17:03.050","lastModified":"2026-10-06T16:08:43.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/&lt;app_id&gt;/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application's MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"langgenius","product":"dify","versions":[{"version":"< 1.16.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T14:34:11.355920Z","id":"CVE-2026-105761","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/langgenius/dify/commit/62cb5b586504b730731e28e743c038b72950058e","source":"security-advisories@github.com"},{"url":"https://github.com/langgenius/dify/pull/38177","source":"security-advisories@github.com"},{"url":"https://github.com/langgenius/dify/releases/tag/1.16.0","source":"security-advisories@github.com"},{"url":"https://github.com/langgenius/dify/security/advisories/GHSA-ccrj-frp2-c945","source":"security-advisories@github.com"}]}}]}